DarkVault

DarkVault first drew public attention in April 2024 (with some observations dating to late 2023) when it published data belonging to roughly 19 victims on a dedicated leak site (DLS) whose layout closely mirrored LockBit's. Researchers noted the group's reuse of the LockBit Black ransomware built from the 2022-leaked LockBit 3.0 builder, which fed rebranding rumors; however, no verified technical evidence links DarkVault to LockBit's core codebase, and builder reuse is common across many unrelated crews.

Operationally DarkVault behaves as a broad data broker and extortion outfit, publishing victim listings and stolen data via Tor. Because it leans on a leaked builder and copycat branding rather than a distinctive in-house toolkit, attribution and internal structure remain poorly characterized.

DarkVault's claimed victimology spans multiple regions. In a MENA context it has been associated with claimed targeting across Israel, Saudi Arabia, the UAE, Qatar and Oman. All such leak-site listings should be treated as unverified claims unless independently confirmed by a reputable source or the victim organization; DarkVault's public activity appears sparse after its 2024 burst, leaving its current operational status uncertain.