Description Summary
Limited public technical reporting is available for D4rk4rmy. The group is tracked via its dark-web leak site, where it has claimed 18 victim posts as of the most recent observation. Where the leak site lists organizational disclosures, this indicates an active double-extortion operation: data is exfiltrated and threatened with publication to coerce ransom payment. For families with this data quality, the encryption extension, algorithm, and ransom-note filename should be confirmed against an in-depth incident-response report before being relied upon.
Threat Actor
Operator/affiliate cluster behind the D4rk4rmy leak site. Detailed actor attribution is not available in curated public reporting.
Technical Indicators
Encryption Extension
Not publicly reported
Encryption Algorithm
Not publicly reported
Ransom Note Name
Not publicly reported
Targeted Industries
Cross-sector (per leak-site victim telemetry)
First Seen
Unknown
Last Seen
No public victim disclosures observed
Geographical Location
Global / not publicly profiled
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |