DoNex is the latest rebrand of a ransomware lineage targeting enterprises with double-extortion since 2024.
DoNex is a ransomware strain that emerged in March 2024 as the latest rebrand of the lineage Muse (2022) → DarkRace (2023). It targets enterprises in the US and Europe using double-extortion tactics. Avast released a free decryptor in July 2024 after discovering a cryptographic flaw, though the actor may still be active. Defenders should track IOCs from earlier variants in this lineage and maintain tight monitoring for data exfiltration despite the encryption weakness.
DoNex is a ransomware strain that emerged in March 2024 as the latest rebrand of a lineage beginning with Muse (2022) → DarkRace (2023) → DoNex, targeting enterprises in the US and Europe using double-extortion; Avast released a free decryptor in July 2024 after discovering a cryptographic flaw.
DoNex is the latest rebrand of the lineage Muse (2022) → DarkRace (2023).
No, although Avast released a decryptor for a cryptographic flaw in July 2024, defenders should still maintain monitoring for data exfiltration risk.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.