Home / Ransomware Intelligence / All groups / donex

donex Ransomware

🔔 Create alert

Tracked since Mar 8, 2024

0

victims recorded

0

in the last 30 days

0

CVEs

—

Last activity

DoNex is a ransomware strain that emerged in March 2024 as the latest rebrand of a lineage beginning with Muse (2022) → DarkRace (2023) → DoNex, targeting enterprises in the US and Europe using double-extortion; Avast released a free decryptor in July 2024 after discovering a cryptographic flaw.

Vulnerabilities cited for this group

CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.

No CVE associated with this group in the sources.

Tactics and techniques (MITRE ATT&CK)

Execution

T1047 Windows Management Instrumentation T1059 Command and Scripting Interpreter T1064 Scripting T1106 Native API T1129 Shared Modules

Persistence

T1543.003 Windows Services

Defense Evasion

T1027 Obfuscated Files or Information T1027.005 Indicator Removal from Tools T1027.009 Embedded Payloads T1036 Masquerading T1064 Scripting T1070.001 Clear Windows Event Logs T1070.004 File Deletion T1202 Indirect Command Execution T1222 File and Directory Permissions Modification T1548 Abuse Elevation Control Mechanism T1562.001 Disable or Modify Tools T1564.003 Hidden Window

Credential Access

T1056 Input Capture

Discovery

T1007 System Service Discovery T1010 Application Window Discovery T1016 System Network Configuration Discovery T1018 Remote System Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1135 Network Share Discovery T1518.001 Security Software Discovery

Collection

T1074 Data Staged T1119 Automated Collection

Impact

T1485 Data Destruction T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live