Threat Investigation
Request a demo
Cybercrime

DarkGaboon

DarkGaboon is classified as cybercrime.

Type
Cybercrime
Also known as
2

DarkGaboon is a financially motivated APT group that has been independently targeting Russian organizations since May 2023, primarily using phishing emails to deliver malware such as Revenge RAT and LockBit 3.0 ransomware. Their operations demonstrate advanced operational security practices, including the use of homoglyphs in file names and decoy documents sourced from legitimate Russian templates to evade detection. The group has shown a disciplined approach to updating their toolkit, with 369 unique files identified, and employs command-and-control infrastructure located outside Russia. DarkGaboon's linguistic proficiency in Russian suggests a deep understanding of the local context, enhancing the effectiveness of their phishing lures.

Also known as: Vengeful Wolf, room155

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

DarkGaboon · Threat actors · Dark Radar