Ransomware group profile · #414 by claimed victims
Dagonlocker ransomware
Dagon Locker is a ransomware strain that first appeared in early 2023, evolved from the MountLocker/Quantum ransomware lineage, and uses IcedID as an initial access vector before deploying double-extortion attacks with ChaCha20+RSA-2048 encryption.
Tactics, techniques and procedures
ATT&CK technique mapping for Dagonlocker is in progress. Victimology, infrastructure status and leak-site tracking are live above.
Indicators, detections and the full playbook
Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.
Frequently asked
Is Dagonlocker ransomware still active?
How many victims has Dagonlocker claimed?
Which industries does Dagonlocker target?
Which countries are most affected by Dagonlocker?
Where does VULONE get Dagonlocker victim data?
Other ransomware groups
Qilin
Lockbit3
Akira
ClopVictim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].
