Pierluigi Paganini July 31, 2024

Zscaler researchers revealed that a company paid a record-breaking $75 million ransom to the Dark Angels ransomware group.

Zscaler discovered a record-breaking ransom payment of US$75 million made by a company to the Dark Angels ransomware group. Zscaler did not name the company that paid the $75 million ransom following an attack that occurred in early 2024.

This is the largest ransomware payment by a company in history.

The Dark Angels ransomware group has been active since around May 2022, is operates the Dunghill data leak site.

The gang targets a wide range of sectors, including healthcare, government, finance, and education, and has recently focused on large industrial, technology, and telecommunications companies.

In early 2024, Zscaler’s ThreatLabz uncovered a case where a victim paid the group $75 million.

“In most cases, the Dark Angels group steals a vast amount of information, typically in the range of 1-10 TB. For large businesses, the group has exfiltrated between 10-100 TB of data, which can take days to weeks to transfer.” reads the report. “The highest-profile attack conducted by Dark Angels was in September 2023, when the group breached an international conglomerate that provides solutions for building automation systems among other services. Dark Angels demanded a $51 million ransom, claimed to have stolen over 27 TB of corporate data, and encrypted the company’s VMware ESXi virtual machines. A RagnarLocker ransomware variant was used to encrypt the company’s files during the attack.”

Researchers from blockchain intelligence firm Chainalysis confirmed that early this year they saw the largest ransomware payment ever at $75M.

Bleeping Computer speculates that in February 2024, the Fortune 50 company Cencora suffered a ransomware attack, however no ransomware group claimed responsibility for the incident, potentially indicating that the victim paid the ransom.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, US CISA Known Exploited Vulnerabilities catalog)