Zscaler researchers revealed that a company paid a record-breaking $75 million ransom to the Dark Angels ransomware group.
Zscaler discovered a record-breaking ransom payment of US$75 million made by a company to the Dark Angels ransomware group. Zscaler did not name the company that paid the $75 million ransom following an attack that occurred in early 2024.
This is the largest ransomware payment by a company in history.
ThreatLabz has uncovered a record breaking $75 million payment made by a Fortune 50 company to the #DarkAngels ransomware group. The payment is the single largest ransomware-related transaction ever reported. For more details, check out our annual ransomware report:… pic.twitter.com/mlZyvNPfO0
— Zscaler ThreatLabz (@Threatlabz) July 30, 2024
The Dark Angels ransomware group has been active since around May 2022, is operates the Dunghill data leak site.
The gang targets a wide range of sectors, including healthcare, government, finance, and education, and has recently focused on large industrial, technology, and telecommunications companies.
In early 2024, Zscaler’s ThreatLabz uncovered a case where a victim paid the group $75 million.
“In most cases, the Dark Angels group steals a vast amount of information, typically in the range of 1-10 TB. For large businesses, the group has exfiltrated between 10-100 TB of data, which can take days to weeks to transfer.” reads the report. “The highest-profile attack conducted by Dark Angels was in September 2023, when the group breached an international conglomerate that provides solutions for building automation systems among other services. Dark Angels demanded a $51 million ransom, claimed to have stolen over 27 TB of corporate data, and encrypted the company’s VMware ESXi virtual machines. A RagnarLocker ransomware variant was used to encrypt the company’s files during the attack.”
Researchers from blockchain intelligence firm Chainalysis confirmed that early this year they saw the largest ransomware payment ever at $75M.
Bleeping Computer speculates that in February 2024, the Fortune 50 company Cencora suffered a ransomware attack, however no ransomware group claimed responsibility for the incident, potentially indicating that the victim paid the ransom.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, US CISA Known Exploited Vulnerabilities catalog)
