Desorden Group
Desorden (Disorder in Spanish, previously known as ChaosCC), is a financially motivated hacker group. The group first emerged under the new name Desorden in September 2021, on Raidforums. Today the group maintains users under that name on several popular English-speaking hacking forums, where they share their attacks and ransom demands, and offer databases for sale. The group gained an excellent reputation among the cybercriminal communities due to their successful operations and the unique data that they share and offer for sale.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.databreaches.net/major-malaysian-water-utilities-company-hit-by-hackers-ranhill-offline-hackers-claim-databases-and-backups-deleted/
- https://www.databreaches.net/one-month-later-ranhill-still-hasnt-fully-recovered-from-cyberattack/
- https://www.databreaches.net/malaysian-online-stock-brokerage-firm-victim-of-cyberattack/
- https://www.databreaches.net/johnson-fitness-and-wellness-hit-by-desorden-group/
- https://www.databreaches.net/thailands-the-icon-group-hacked-by-desorden/
- https://www.databreaches.net/customer-data-from-hundreds-of-indonesian-and-malaysian-restaurants-hacked-by-desorden/
- https://www.databreaches.net/major-indonesia-tollroad-operator-hacked-by-desorden/
- https://www.databreaches.net/recent-cyberattacks-put-thai-citizens-privacy-and-data-security-at-greater-risk/
- https://www.databreaches.net/thai-entities-continue-to-fall-prey-to-cyberattacks-and-leaks/
- https://seclists.org/dataloss/2021/q4/81
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.