Loading threat actor…
The Dark Overlord, often abbreviated TDO, was a financially motivated cybercriminal extortion group active primarily from 2016 through 2019. The group became widely known for intrusions into healthcare providers, medical records companies, accounting firms, media and entertainment organizations, and other businesses, followed by threats to publish stolen data unless victims paid. Public reporting and court allegations tie the group to theft of millions of patient records, extortion involving highly sensitive medical and personal information, and the release of unreleased television content. The actor also gained notoriety for aggressive psychological pressure tactics, including personalized threats directed at victims and their family members, public shaming, and direct engagement with journalists and social-media audiences to amplify coercion. The group’s operations centered on unauthorized access to victim environments, data theft, and extortion rather than destructive or espionage objectives. Known victim sectors include health care, media and entertainment, and government-adjacent public institutions such as schools. The Dark Overlord was linked to hacks involving Netflix, Disney, ABC, and multiple medical organizations, and was associated with a 2017 cyber-extortion campaign targeting schools in Montana. The actor also became known for stealing explicit images from a UK plastic surgery clinic and threatening broader publication to force payment, an early example of highly personal data-theft extortion. The Dark Overlord routinely used exfiltrated data as leverage, threatening public release when victims refused to pay. Its methods included extortion emails and text messages, publication of hacked material, and staged releases designed to maximize media attention and victim pressure. The group maintained an unusually visible public persona for a criminal actor, using social platforms, forums, and leak-posting channels to advertise breaches, taunt victims, and cultivate notoriety. Later activity included attempts to monetize allegedly stolen legal documents related to 9/11 through incremental public releases and escalating payment demands, reflecting a publicity-driven extortion model. Law-enforcement action disrupted the group. A suspected member was arrested in Serbia in 2018, and U.S. prosecutors later extradited UK national Nathan Wyatt, alleging he was a member involved in the conspiracy. Reporting also indicates the group attempted to recruit technically skilled personnel on dark-web forums after law-enforcement pressure. The Dark Overlord is best characterized as a data-theft extortion actor whose hallmark was coercive publication of stolen sensitive information, especially medical and personal data, to force payment.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Extortion-focused hacking campaign involving compromise of entities, theft of data, and threatening emails to victims that included personal details about family members to coerce payment.
Referenced only as the subject of a report connected to a feud between pompompurin and Vinny Troia; no direct activity by the group is described in this content.
Referenced as a named hacking group in the context of a false attribution/defamation claim within emails sent via the compromised FBI external email system; no operational details of the group’s activity are provided in this content.
Referenced in the spoofed spam email campaign as a purported attacking cybercriminal group.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.