Desorden
Attribution profile
- Type
- Crime Syndicate
- Location
- China
- Known incidents
- 10 incidents
- Sources
- 12 sources
- First seen
- 2021-09-09
- Last seen
- 2022-10-09
- Updated
- 2026-10-14 08:11
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
DESORDEN, also known as Desorden Group, is a threat actor linked to China that describes itself as former associates of Chaos and says its name stands for Chaos & Disorder. The group states it targets supply chain networks and public services, often seeking to highlight neglected defenses rather than collect ransom, though it has demanded payments and threatened to sell exfiltrated data when victims do not respond. It claims to gain initial access through front‑facing servers, exploit unpatched vulnerabilities, maintain persistent access, and pivot laterally within networks to exfiltrate gigabytes to terabytes of data, including personal, financial, corporate and source‑code files. DESORDEN says it does not typically employ ransomware but has shared ransomware‑builder tools for defensive purposes. Publicly reported operations include attacks on a multinational fitness equipment retailer, Malaysian telecommunications providers, a Thai luxury hotel chain, and a logistics subsidiary of Kerry Logistics, among others.
Incidents
Attributed incidents are available to members.
10 incidentsSources
Sources available to members: 12 sources.