THREAT ACTOR
DUNGHILL_
DormantDUNGHILL is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of DUNGHILL, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2025 1
- 2024 3
- 2023 11
Leak site mirrors
7 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
p66slxmtum2ox4jpayco6ai3qfehd5urgrs4oximjzklxcol264driqd.onionDunghill Leak - Details snapshot · 2024-07-23 16:07 -
nsalewdnfclsowcal6kn5csm4ryqmfpijznxwictukhrgvz2vbmjjjyd.onionDunghill Leak - Details snapshot · 2025-07-21 11:36 -
5kvv27efetbcqgem4tl7jsolvr3jxkrbmn23rcjzl7kvqycxuao3t4ad.onion403 Forbidden snapshot · 2025-09-19 13:04 -
p242scyqdujesnozehk4ecfshk6i357cjywv3vzywrera3bndko4pgyd.onionsnapshot · 2024-12-11 11:44 -
r4znrcbthzjclilled5yyrjy35gagoyfwvekiqih7btzrchvqdmgviqd.onionsnapshot · 2024-12-11 11:44 -
sldltcn2d6mgtp66vgmvjptdtwgqyyewsjgwkzjybq3x55plzw4tefid.onionsnapshot · 2024-12-11 11:44 -
zroxb37ghsh2xkwrkfkyz65jmuv6goaltcqxohk4syziahgjv5zou5qd.onionsnapshot · 2025-03-31 05:12
Recent victims
The 50 most recent victims claimed by DUNGHILL. Total in the index: 15.
| Date listed | Victim | Description |
|---|---|---|
| 2025-04-27 | Linney | Linney is a sixth generation, world-class, multichannel marketing serv… |
| 2024-07-16 | Nuevatel | |
| 2024-04-10 | Nexperia | Headquartered in the Netherlands, Nexperia is a global semiconductor c… |
| 2024-02-29 | Array Networks | Array Networks is an American networking hardware company. It sells ne… |
| 2023-12-05 | Supply Technology | Supply Technologies, a subsidiary of ParkOhio(NASDAQ:PKOH), specialize… |
| 2023-09-27 | CannonDesign | CannonDesign is a global architecture, engineering and consulting prac… |
| 2023-09-27 | Robins & Morton | Robins and Morton is a company operating as a construction firm. It sp… |
| 2023-09-26 | Roper & Vertafore | Vertafore is a Denver-based insurance technology company. It has devel… |
| 2023-09-26 | Go-Ahead Group | Go-Ahead Group plc is a passenger transport company based in Newcastle… |
| 2023-09-26 | Ropertech.com & Vertafore.com | Ropertech.com & Vertafore.com is a Denver-based insurance technology c… |
| 2023-09-06 | Sabre Corporation | Sabre Corporation Sabre is the largest global distribution systems pro… |
| 2023-06-18 | Sysco Corporation | Sysco Corporation is an American multinational corporation involved in… |
| 2023-06-18 | Gentex Corporation | Gentex Corporation is an American electronics and technology company t… |
| 2023-04-17 | ANDRADE GUTIERREZ & ZAGOPE | ANDRADE GUTIERREZ is a Brazilian private multinational conglomerate he… |
| 2023-04-11 | Incredible Technologies | Incredible Technologies is an American developer and manufacturer of c… |
CONFIRMED ATTACKS
Dunghill confirmed attacks: 5 verified incidents
Ransomnews has verified 5 Dunghill incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from August 2022 to March 2024. United States accounts for 4 of them (80%), with victims recorded in 2 countries in total. The most affected sector is technology, at 2 confirmed victims. Where a figure was disclosed (3 cases), these incidents account for 158,312 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Dunghill incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| March 2024 | Nexperia | Manufacturing | Nijmegen, Netherlands | — | Unknown | Source |
| September 2023 | Sabre GLBL Inc. | Technology | Texas, United States | 29,590 | Unknown | Source |
| April 2023 | Gentex Corporation | Manufacturing | Michigan, United States | — | Unknown | Source |
| January 2023 | Sysco Corporation | Food and Beverage | Texas, United States | 126,243 | Unknown | Source |
| August 2022 | Incredible Technologies, Inc. | Technology | Illinois, United States | 2,479 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Dunghill's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.