DarkVault is a cybercriminal group active since late 2023, known for ransomware and double-extortion attacks on finance, legal, and tech sectors.
DarkVault is a data-exfiltration and double-extortion group first identified in late 2023, primarily targeting medium-to-large organizations in finance, professional services, legal, and technology sectors. The group focuses on victims across Europe, the UK, and North America and has a suspected connection to LockBit. Its TTPs include ransomware deployment and data exfiltration for double extortion. Defenders should focus on network segmentation, offline backup verification, and monitoring for unusual data egress and lateral movement.
DarkVault is a data-exfiltration and double-extortion group first identified in late 2023, targeting medium-to-large organizations in finance, professional services, legal, and technology sectors across Europe, the UK, and North America, with a suspected connection to LockBit.
DarkVault primarily targets the finance, professional services, legal, and technology sectors.
Defenders should focus on network segmentation, offline backup verification, and monitoring for unusual data egress and lateral movement.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.