DarkGaboon: Financially Motivated Ransomware Group Targets Russian Organizations A cybercrime group known as DarkGaboon has been conducting ransomware attacks against Russian companies since at least 2023, according to research by Russian cybersecurity firm Positive Technologies. First identified in January, the group has targeted organizations across banking, retail, tourism, and public services. In its latest campaign this spring, DarkGaboon deployed LockBit 3.0 ransomware, a variant originally leaked in 2022 and widely adopted by cybercriminals. Unlike typical LockBit affiliates operating under a ransomware-as-a-service (RaaS) model, DarkGaboon appears to operate independently. The group relies on Russian-language phishing emails sent to financial department employees, using urgent messaging and malicious attachments disguised as legitimate financial documents. These decoy files, sourced from legitimate Russian-language templates, have remained largely unchanged since 2023. Once inside a victim’s network, DarkGaboon encrypts files with LockBit 3.0 and leaves a ransom note in Russian, including two contact email addresses. Positive Technologies found no evidence of data exfiltration in recent attacks. The same email addresses were previously linked to LockBit-based attacks on Russian financial institutions in early 2023. While the identities behind DarkGaboon remain unknown, researchers suggest the perpetrators are likely Russian-speaking. The group uses open-source tools like Revenge RAT and XWorm to evade attribution, blending in with broader cybercriminal activity. Russian entities have faced prior LockBit attacks, including a December 2023 incident targeting a major Siberian dairy plant following its humanitarian aid donations to Russian military efforts in Ukraine. That attack, however, has not been attributed to DarkGaboon.