Daixin Team
Daixin Team is a ransomware threat actor observed targeting healthcare and other sectors for financial gain, data theft, and extortion. The provided reporting directly links the group to multiple healthcare intrusions, including breaches at OakBend Medical, Fitzgibbon Hospital, at least one additional U.S. hospital in 2022, and a 2024 attack on Acadian Ambulance Service. In the Acadian Ambulance case, the group claimed responsibility for the ransomware attack, demanded $7 million, and alleged theft of information on 10 million patients; separate breach reporting listed the incident as a Daixin Team hacking incident with data theft confirmed affecting 2,896,985 individuals. The content also states that Daixin Team attacked AirAsia Group in 2022, with data from almost 5 million passengers and employees reportedly stolen. Based on the provided content, the group conducts ransomware operations involving data theft and threats to leak stolen information. No additional aliases or sub-groups are directly supported beyond the name Daixin Team.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- healthcare
Tradecraft
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware/extortion actor referenced as responsible for a 2022 attack on AirAsia Group resulting in theft of data for nearly 5 million passengers and employees.
Intrusions into healthcare organizations resulting in confirmed data theft.
Daixin Team is a ransomware group known for targeting healthcare organizations, encrypting servers, and demanding large ransoms, with threats to leak sensitive data.
Daixin Team is a ransomware group responsible for attacks on US hospitals, encrypting data and demanding ransom payments.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.