Desolator is a ransomware group targeting construction, engineering, and technology sectors via social engineering and supply chain exploitation.
Desolator is a ransomware group targeting construction, engineering, and technology sectors across Latin America, Europe, and Asia. Emerging in May 2025, the group actively recruits pen testers, initial access brokers, and social engineers via dark web forums to build its affiliate program. Their key TTPs include social engineering, initial access brokerage, and likely supply chain exploitation to deploy ransomware. Defenders should be vigilant against social engineering attempts disguised as legitimate employees, conduct regular penetration testing, and monitor dark web recruitment activity for early warning signs.
Desolator is a ransomware group that emerged in May 2025, targeting construction and engineering firms in Latin America and Europe and technology companies in Asia, actively recruiting pen testers, initial access brokers, and social engineers via dark web forums to build an affiliate program.
The Desolator group targets the construction, engineering, and technology sectors.
The Desolator group recruits pen testers, initial access brokers, and social engineers via dark web forums.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.