Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.
DarkVault is a data-extortion and ransomware operation that surfaced in 2024 running a Tor leak site closely modeled on LockBit 3.0 and reportedly deploying payloads built from the leaked LockBit Black (LockBit 3.0) builder.
DarkVault first drew public attention in April 2024 (with some observations dating to late 2023) when it published data belonging to roughly 19 victims on a dedicated leak site (DLS) whose layout closely mirrored LockBit's. Researchers noted the group's reuse of the LockBit Black ransomware built from the 2022-leaked LockBit 3.0 builder, which fed rebranding rumors; however, no verified technical evidence links DarkVault to LockBit's core codebase, and builder reuse is common across many unrelated crews.
Operationally DarkVault behaves as a broad data broker and extortion outfit, publishing victim listings and stolen data via Tor. Because it leans on a leaked builder and copycat branding rather than a distinctive in-house toolkit, attribution and internal structure remain poorly characterized.
DarkVault's claimed victimology spans multiple regions. In a MENA context it has been associated with claimed targeting across Israel, Saudi Arabia, the UAE, Qatar and Oman. All such leak-site listings should be treated as unverified claims unless independently confirmed by a reputable source or the victim organization; DarkVault's public activity appears sparse after its 2024 burst, leaving its current operational status uncertain.