Search threats, CVEs… ⌘K
← Back to all threat actors

donutleaks

Donut Leaks (D0nut) is a data-extortion group active since August 2022 that developed its own ransomware encryptor, linked to attacks on Greece's DESFA gas company and Continental, believed to be an affiliate of multiple RaaS operations who pivoted to running an independent extortion platform.

How we source and review actor profiles
Motivation
ransomware
Last seen
2025-08-10
Sectors
professional-services, healthcare, manufacturing, technology, hospitality, other, government-defense, agriculture-and-food-production, transportation, financial-services
Status
Dormant

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Claimed
Victim claimPittsburgh’s Trusted Orthopaedic Surgeons listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator4 indicators cataloged

Types: onion.

First listed
Victim claimJack "Designer" Sparrow. listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimIndustrial Bolsera listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimKickDown ESET company. No overpayments at 0% (renamed and update) listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimESET. PREMIUM. listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimall-mode.com listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimlabline.it listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimvalleylandtitleco.com - UPD listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimvalleylandtitleco.com listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimPatriot Machine listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimGood Morning listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimvoidinteractive.net you are welcome in our chat listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimWatsonclinic.com listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimDOD contractors you are welcome in our chat. listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimcarriereindustrial.com listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimAlbert, Righter & Tittmann architechts, inc. listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimSidockgroup. Published listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimSidockgroup. listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimRAT. listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimUPDATED: INC RANSOMWARE... listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimINC RANSOMWARE... listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimGossler, Gobert & Wolters Group. listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimAgilitas IT Solutions Limited listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimWho Is MONTY? ;) listed by donutleaks

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 43 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

donutleaksCanonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...