Skip to content
DarkVault Ransomware
Under attack by ransomware or suffering a cyber breach?
Speed is critical when facing a live cyber attack. If you believe you’ve been compromised, by the DarkVault ransomware group or another threat actor - contact us immediately.
About DarkVault ransomware group
Emerging in late 2023, DarkVault ransomware is a stealth-focused threat actor known for targeting enterprise systems and exfiltrating high-value data before deploying encryption. These ransomware attacks are strategically planned, with attackers leveraging a double extortion tactic, stealing and threatening to expose files on their data leak site if the ransom is not paid.
After a DarkVault attack, victims are often presented with a ransomware note, demanding payments in cryptocurrency to restore access to encrypted data and to prevent public disclosure. The extent of these attacks highlights growing cybersecurity concerns among global businesses.
What we can help with:
- Encrypted files & ransomware data recovery
- Incident response and containment
- Secure data restoration and system recovery
- Use of ransomware decryption tools and data recovery software
- Development of incident response plans and disaster recovery solutions
- Post-incident reviews and security hardening
Request a call back
If your organisation has been infected with ransomware contact us immediately.
How DarkVault operators work
DarkVault is one of several emerging ransomware groups operating on the dark web. First seen in late 2023, this gang has already left a significant impact on various sectors by executing calculated and high-stakes ransomware operations. Though still a limited number of employees are believed to be involved, the group’s methods and reach mirror those of seasoned threat actors.
Some cyber security experts believe DarkVault could be a rebranding of LockBit, pointing to LockBit’s branding similarities in design and ransom communications. The in depth analysis of DarkVault’s infrastructure, especially its use of a .onion data leak site, adds weight to this theory and reflects advanced malware creation and deployment skills.
DarkVault portrays itself as an exclusive online community involved in a variety of illegal activities, including data theft, website defacing, and scams. Its tactics evoke strong parallels with ransomware operations that have plagued the financial markets, healthcare institutions, cloud providers, and telecommunications in recent years.
We are equipped to deal with an attack from any ransomware group.
Don’t hesitate to contact us if you are under attack from a ransomware group not listed above.
Recognising a DarkVault attack
DarkVault relies on a double extortion tactic, first encrypting network files, then threatening to release stolen data publicly. The group’s tactics often include infiltrating via phishing or compromised RDP access. Once inside, their malware spreads laterally, encrypting multiple endpoints and appending a “.dvlt” extension.
The development of such advanced malware reflects a calculated approach intended to cause maximum disruption. These attacks are not random, they are often meticulously planned to exploit known vulnerabilities and generate fear, even issuing bomb threats or other scare tactics to intensify pressure.
Why you must not interfere with your ransomware environment
If you discover a physical break-in at your offices, your first instinct would be to call the police; touch nothing and let them search for clues. Then, your focus would shift to restoring business operations.
A cyber-attack requires the same approach. Your digital environment is a CRIME SCENE. It is crucial to leave the environment untouched to allow for a forensic investigation.
This is not a task for your IT team or MSP. Digital Forensic specialists are available 24/7 to assist you, just like in a physical crime.
| description | Sector | Date Discovered | Attack Date | Country | Screenshot |
|---|---|---|---|---|---|
| Technology | 06/01/2025 02:00 PM | 06/01/2025 01:59 PM | CN | ||
| Technology | 02/01/2025 08:03 PM | 02/01/2025 12:00 AM | IN | ||
| Technology | 28/12/2024 05:01 PM | 28/12/2024 12:00 AM | MN | ||
| Professional Services | 02/12/2024 09:22 PM | 02/12/2024 12:00 AM | US | ||
| Education | 20/11/2024 03:14 PM | 20/11/2024 12:00 AM | KR | ||
| Technology | 19/11/2024 06:05 PM | 19/11/2024 12:00 AM | AE | ||
| Technology | 19/11/2024 04:14 PM | 19/11/2024 12:00 AM | IN | ||
| Technology | 07/11/2024 06:12 PM | 07/11/2024 12:00 AM | AE | ||
| Professional Services | 28/08/2024 02:45 PM | 28/08/2024 12:00 AM | US | ||
| Financial Services | 26/08/2024 02:40 PM | 26/08/2024 12:00 AM | GB | ||
| Financial Services | 24/08/2024 03:08 PM | 24/08/2024 12:00 AM | SC | ||
| Healthcare | 17/08/2024 10:21 PM | 17/08/2024 12:00 AM | KR | ||
| Hospitality | 15/08/2024 10:00 AM | 15/08/2024 12:00 AM | MX | ||
| Healthcare | 13/08/2024 01:06 PM | 13/08/2024 12:00 AM | ZA | ||
| Government & Defense | 13/08/2024 01:05 PM | 13/08/2024 12:00 AM | ZA | ||
| Professional Services | 13/08/2024 10:07 AM | 13/08/2024 12:00 AM | IL | ||
| Professional Services | 08/08/2024 07:07 AM | 08/08/2024 12:00 AM | BR | ||
| Professional Services | 08/08/2024 07:03 AM | 08/08/2024 12:00 AM | BR | ||
| Agriculture and Food Production | 01/08/2024 10:44 PM | 01/08/2024 12:00 AM | GB | ||
| Professional Services | 26/07/2024 02:40 PM | 26/07/2024 12:00 AM | US | ||
| Professional Services | 23/07/2024 03:07 PM | 23/07/2024 12:00 AM | HR | ||
| Technology | 03/07/2024 10:38 PM | 03/07/2024 12:00 AM | IN | ||
| Technology | 03/07/2024 01:40 PM | 03/07/2024 12:00 AM | GB | ||
| Healthcare | 30/06/2024 01:12 AM | 29/06/2024 12:00 AM | BR | ||
| Healthcare | 29/06/2024 11:18 PM | 29/06/2024 12:00 AM | AE | ||
| Professional Services | 27/06/2024 04:02 PM | 27/06/2024 12:00 AM | IN | ||
| Financial Services | 25/06/2024 03:55 PM | 25/06/2024 12:00 AM | AR | ||
| Transportation | 21/06/2024 04:09 PM | 21/06/2024 12:00 AM | ID | ||
| Technology | 17/06/2024 01:14 PM | 17/06/2024 12:00 AM | CR | ||
| Technology | 17/06/2024 11:19 AM | 17/06/2024 12:00 AM | US | ||
| Retail & E-Commerce | 12/06/2024 06:17 PM | 12/06/2024 12:00 AM | IN | ||
| Professional Services | 10/06/2024 08:15 PM | 10/06/2024 12:00 AM | LT | ||
| Technology | 10/06/2024 01:48 PM | 10/06/2024 12:00 AM | KR | ||
| Technology | 07/05/2024 02:00 AM | 07/05/2024 12:00 AM | BR | ||
| Transportation | 06/05/2024 04:38 PM | 06/05/2024 12:00 AM | MX | ||
| Financial Services | 04/05/2024 04:22 PM | 04/05/2024 12:00 AM | IN | ||
| Education | 26/04/2024 02:19 PM | 26/04/2024 12:00 AM | IN | ||
| Technology | 25/04/2024 10:26 PM | 25/04/2024 12:00 AM | BY | ||
| Transportation | 25/04/2024 02:03 AM | 24/04/2024 12:00 AM | BR | ||
| Professional Services | 15/04/2024 07:20 PM | 15/04/2024 12:00 AM | US | ||
| Technology | 15/04/2024 01:36 AM | 14/04/2024 12:00 AM | BR | ||
| Professional Services | 12/04/2024 10:41 PM | 04/04/2024 12:00 AM | GB | ||
| Professional Services | 12/04/2024 10:40 PM | 12/04/2024 12:00 AM | GB | ||
| Professional Services | 12/04/2024 04:35 AM | 11/04/2024 12:00 AM | SA | ||
| Healthcare | 12/04/2024 02:56 AM | 11/04/2024 12:00 AM | SA | ||
| Technology | 11/04/2024 07:16 PM | 08/02/2024 12:00 AM | US | ||
| Technology | 11/04/2024 07:16 PM | 08/02/2024 12:00 AM | US | ||
| Transportation | 11/04/2024 07:15 PM | 21/02/2024 12:00 AM | US | ||
| Technology | 11/04/2024 07:14 PM | 21/02/2024 12:00 AM | IN | ||
| Healthcare | 11/04/2024 07:14 PM | 04/03/2024 12:00 AM | US | ||
| Technology | 11/04/2024 07:13 PM | 14/03/2024 12:00 AM | US | ||
| Professional Services | 11/04/2024 07:12 PM | 14/03/2024 12:00 AM | LK | ||
| Professional Services | 11/04/2024 07:12 PM | 18/03/2024 12:00 AM | IN | ||
| Agriculture and Food Production | 11/04/2024 07:11 PM | 20/03/2024 12:00 AM | IN | ||
| Technology | 11/04/2024 07:11 PM | 08/04/2024 12:00 AM | GB |
Known threat actors
Ransomware groups behind the attacks
Below is a breakdown of the most active ransomware groups and the variants driving their attacks.
Post breach actions
-
Call a NCSC Cyber Incident Response approved supplier Some NCSC providers will fund up to 48 hours of investigation into your incident.
-
Report the incident to Report Fraud
-
Locate your business continuity plan Work out what you can do without access to your systems and data.
-
Identify your business insurance contact details
Who are we and what experience do we have in responding to cyber incidents?
We are accredited to ISO 27001 and recognised by the UK’s National Cyber Security Centre (NCSC).
We provide comprehensive cyber risk management services, with a core focus on Digital Forensics and Incident Response (DFIR). Our capabilities are driven by a 24/7 Security Operations Centre and a dedicated in-house intelligence team that delivers timely, actionable threat reporting.
With decades of collective cyber security experience, we have the expertise to assume operational ownership of your entire IT security architecture – simplifying and strengthening cyber security across your business.
As an Assured Service Provider for Cyber Incident Response (CIR) at the Standard Level. This accreditation demonstrates our ability to deliver high-assurance, effective support in response to a wide range of cyber threats.
Your NCSC-approved supplier is a specialist crime scene investigator who will:
- Isolate and preserve your environment for forensic investigation.
- Identify where the data has been duplicated and issue a legal takedown order.
- Identify your data, application and systems restore points. These might be at different points in time and will need to be carefully restored and reconstructed in a pristine environment.
- Liaise with your business insurance company and if needed, with the Police.
- Advise you on notifying your customers of your situation.
- Rebuild your systems, restore your data and get you back to full operation. Note: This process can take between 2 weeks – 2 months.
Working with us
Our response process
Our team are ransomware recovery specialists with a proven, streamlined approach to resolving incidents quickly and effectively.
Step 1: Triage
We deploy our incident response team the same day. From the first call, we begin onboarding, introduce key stakeholders, set communication schedules, and start gathering critical information to guide the response.
Step 2: Investigation
DFIR (Digital Forensic Incident Response) teams investigate breaches to identify vulnerabilities, attack vectors, and system impacts from ransomware such as Data Loss (PII). We deliver clear forensic insights to guide mitigation.
Step 3: Contain
Our onsite and remote teams act fast to stop the attack in its tracks. That includes isolating affected systems, removing malicious code, and putting protections in place to prevent further spread or damage.
Step 4: Remediate & Eradicate
Once contained, we work to fully eliminate the threat. This includes fixing exploited vulnerabilities, restoring systems to a secure state, and ensuring no traces of the attack remain.
Step 5: Recover
Our incident response teams help get your business back to normal. We restore access to systems, recover data, and ensure services are safe, stable, and functioning, with minimal downtime.
Step 6: Post Incident
We conduct a full review of the incident response and recovery efforts. Together we assess what happened, what worked, and what can be improved, helping you build stronger defences for the future.
Forensic analysis to drive recovery
Our process includes a thorough digital forensic analysis from step two where the output becomes a central component of business recovery. This is because understanding the attack is of critical importance:
Informing an initial infection date
The extent and spread of infection
Data exfiltration having an impact on regulatory positions
Ensuring that the attacker and any tooling or artefacts they leave behind are eradicated
It is critical that the analysis of digital evidence is carried out to an agreed plan.
Maximising early root cause discovery and legal leverage
The process is purpose-built to uncover the root cause as early as possible, which is essential to inform remediation / eradication and recovery as well as supporting a legal take-down case if this is applicable. A legal take-down means we can assist in the legal enforcement that stops the criminals from publishing the data, thus undermining the ransom notice.
Our Digital Forensic and Incident Response (DFIR) teams maintain consistent communication throughout. Dedicated Incident Managers and technical engineering leads provide updates during the Cyber Incident Response journey, utilising risk registers and working within change management processes, all from triage through to post-incident, delivering successful business recovery.
Key take aways
- You will not be able to access your systems or data.
- It is advised to disconnect from the internet and shut down your systems, including PCs, to prevent further infections.
- Your Office 365 system might also be compromised, allowing the attackers to monitor your responses. Avoid communicating with individuals through your primary email or team systems.
- Threat actors typically infiltrate your system at least 2-4 weeks before you become aware of the attack. Your data will have already been exfiltrated. If your system is encrypted, this was not an overnight event.
- Ransom demands in the UK typically range from £500,000 to £3 million, with some sectors, like education, facing demands that exceed £5 million
- Paying the ransom may violate financial sanctions, which is a criminal offence and could result in a custodial sentence or further financial penalties.
- If your data is sold or published online, it puts your customers and staff at risk, potentially implicating you in a Data Protection breach.
- You will need to submit a data takedown request to the initial location where the data was transferred.
- Do not overwrite the encrypted data. It is crucial to determine when the infection began and where the data was sent.
- Avoid rebuilding from the latest backup, as it is likely to be infected.
Why should I trust Zensec to do this work rather than my IT team?
A forensic analysis needs to be meticulous and a clean restore and recovery requires a wealth of experience not normally available in an in-house team who must provide a broader range of IT support skills:
Internal IT teams don’t have the necessary skill set to resolve security encryption issues themselves.
IT teams may recover to the same position with indicators of compromise ready to do it again… which can lead to another breach.
Internal teams are pressured to restore business operations and may recover before forensic analysis even begins, potentially destroying the crime scene before completion.
We can help
Frequently asked questions
Key information when you’re under pressure.
Yes, DarkVault is a sophisticated form of ransomware. It encrypts files, exfiltrates data, and uses public shaming via a data leak site to coerce payments. The group’s methods align closely with those used by LockBit and other major ransomware groups. Each ransomware sample indicates a consistent evolution in encryption strength and delivery methods.
A DarkVault ransomware incident typically originates through:
Compromised RDP sessions
Targeted phishing campaigns
To protect your organisation from similar cyber threats, we recommend implementing the following solutions:
Educate your staff on security best practices and the importance of vigilance
Use strong passwords and enable multi-factor authentication
Regularly remove outdated user accounts
Apply all software and system updates promptly
Perform verified and routine backups
Strengthen your firewall and monitor cloud environments
If you're recovering from a DarkVault incident, we recommendupdating your business continuity plan. Reflect on lessons learned during the period of attack and recovery, and consult professionals with great experience in post-incident response and risk mitigation.
A ransomware attack presents the most significant threat to your business by:
- Disabling your access to systems, which could hinder machinery operation or impede progress through your business processes.
- Blocking access to critical data concerning suppliers, shipments, customers, orders, or steps in your business workflow.
In the event of a business interruption, identifying your position in the supply chain and sustaining operations can be challenging. If the disruption continues, maintaining business continuity becomes critical. Once systems and data are restored, addressing backlogs and establishing future operational protocols are essential.
Ransomware ranks only behind receivership in terms of its capacity to incapacitate a business.
The NCSC is the UK National Cyber Security Centre. They provide cyber security guidance and support, helping to make the UK the safest place to live and work online. They have defined a Cyber Incident Response procedure and they have approved and accredited suppliers to provide this service.
As a recognised Assured Service Provider by the National Cyber Security Centre (NCSC), Zensec provide comprehensive cyber risk management services that are designed to Protect, Detect & Mitigate cyber security threats across the UK.
Report Fraud is the UK's national reporting centre for fraud and cybercrime. Whether you have been scammed, defrauded, or experienced cybercrime in England, Wales, or Northern Ireland, Report Fraud offers a central point of contact for information on fraud and financially motivated cybercrime.
https://www.reportfraud.police.uk/https://www.actionfraud.police.uk/
Yes. If personal data was obtained, lost, or exposed, you are legally obligated to report the incident to the appropriate authority, such as the Information Commissioner’s Office (ICO), as well as your customers. Not doing so could have serious potential implications for your business.
We also advise notifying your insurer or legal counsel. Zensec has a strong partnership history with legal and insurance teams and can assist you in navigating the reporting process, including guidance on how to resolve outstanding risks and future threats.
Dealing with a ransomware attack?
Our ransomware recovery service can help
Our expert team works quickly to contain the breach, recover your data, and restore your systems to full operation. We’ll guide you through every step of the recovery process and help strengthen your defences to prevent future attacks. Regain control with Zensec - trusted support when it matters most.