dAn0n Hacker Group Reemerges as White Lock Ransomware
The first samples of the new(ish) White Lock ransomware began emerging towards the end of September. The earliest compilation time stamp of the four samples currently on MalwareBazaar, Triage, and VirusTotal is September 29, 2025. It has all the hallmarks of traditional crypto-ransomware: kills anti-virus processes, destroys shadow copies, encrypts files and appends a unique string (in this case, '.fbin'), and so on. However, the purpose of this post isn't to dissect the technical aspects of this new ransomware. However, that may come in a later post. The purpose of this post is to highlight the connection between the data extortion group dAn0n and the newly emerging White Lock ransomware operation. Spoiler alert, they're likely the same.
When White Lock executes, it changes the desktop wallpaper and drops a ransom note, named 'c0ntact.txt', which tells victims to navigate to a TOR domain to facilitate negotiations.
This is the TOR web chat provided to victims. If you enter the client ID token provided in the ransom note, it will provide access to the chat room. They likely either expire or are disabled manually after negotiations from the team, as is the case with the example Client ID.
There's not much to it, aside from two things. You can view the chat room page without a client ID token and there's an email provided.
If you navigate to /chat.html, it will let you, but it will throw an error. Still, the page is viewable. The ransom note earlier indicated a 4 BTC ransom, and it looks like 4 BTC is the standard ransom amount according to the chat room. Otherwise, it's a standard chat room.
The email, on the other hand, is the key to tying White Lock to dAn0n, and it's pretty simple. The www[.]whitelock[.]xyz subdomain is hosted on the same IP that www[.]dan0n[.]com was—specifically, the www subdomains.
The email servers are also hosted on the same subnet.
The dAn0n operation and the White Lock operation are fundamentally very different. First, the dAn0n operation is only believed to have stolen data; no ransomware encryptors involved. Second, the manner in which dAn0n extorted victims was "loud." They would dox employees, contact leadership teams, insurance companies, clients, partners, government agencies, and possibly more. They stole data and made sure everyone was aware of it. White Lock, conversely, has no double extortion page at all, at least not one we could find. All that exists is a chat room to negotiate. So, they went from only stealing data and extorting with a loudhorn to encrypting data and covertly negotiating.
The dan0n/White Lock group remains one of the more covert operations of the current active ransomware groups. They initially did double extortion without encrypting systems, but moved to a more direct extortion with encryption operation.
Ransomware Tracker Entries:
https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/dan0n
https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/white-lock
IOCs:
| Type | Hash |
|---|---|
| [email protected] | |
| [email protected] | |
| [email protected] | |
| URL (TOR) | http://2c7nd54guzi6xhjyqrj5kdkrq2ngm2u3e6oy4nfhn3wm3r54ul2utiqd.onion |
| URL (TOR) | http://l3e4ct2egnlfz4ymexwn66jlz55vrnnn72ub4u3xqdjcp7xel5hpbzqd.onion |
| URL (Clearnet) | https://dan0n.com |
| URL (C2) | cloudbackup-mangement.site |
| IP | 192.64.119.130 |
| IP | 192.64.119.136 |
| IP | 91.195.240.19 |
| Ransom Note | ba.bmp |
| Ransom Note | c0ntact.txt |
| White Lock Ransomware | 7e5ec68fd647e1a8fef30a2fbe250f9cf6bf6ea0ec1aa6bd37534517dd537a68 |
| White Lock Ransomware | 960bfbed44a5b8abf1ae2fcb7eecb46ac526840030d5cdef1fad6a6bb379996c |
| White Lock Ransomware | a501583bca532c4ea11b56780a13a865b609d6a0fcd92b9c9b522f1edcc49c29 |
| White Lock Ransomware | db15fb3fb15dc7e79c01f8a46c22f364f59e17a51bc152a9c68651419e1ccfb7 |
