Dunghill is a highly selective ransomware group targeting large enterprises and operating the Dunghill Leak extortion site.
Dunghill, also known as Dark Angels, is a highly selective ransomware group operating a data extortion site called Dunghill Leak. They target large enterprises in healthcare, finance, industrial, and technology sectors, using a non-affiliate model. Their TTPs focus on targeted intrusions and data exfiltration for double extortion, rather than widespread phishing campaigns, leading to a record $75 million ransom payment in 2024. Defenders should prioritize data exfiltration monitoring, enforce zero trust architecture to limit lateral movement, and review incident response plans for high-impact ransomware scenarios.
Dunghill Leak is the data extortion site operated by the Dark Angels ransomware group, active since early 2023, targeting large enterprises across healthcare, finance, industrial, and technology sectors using a highly selective non-affiliate model, and responsible for a record-breaking $75 million ransom payment in 2024.
The Dunghill ransomware group is also known as Dark Angels.
They threaten victims through a data extortion site called Dunghill Leak.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.