The Dark Overlord
Attribution profile
- Type
- Criminal
- Location
- United States of America
- Known incidents
- 29 incidents
- Sources
- 23 sources
- First seen
- 2013-07-01
- Last seen
- 2019-01-08
- Updated
- 2026-10-11 23:45
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The Dark Overlord (also known as TDO) is a hacker group based in the United States. They have targeted healthcare providers, law firms, schools, and various businesses in the U.S. and U.K., seeking financial gain by demanding Bitcoin ransom payments to prevent public release or sale of stolen data. Their tactics include exploiting weak or default passwords and administrative credentials, gaining control of victim domains and mail servers, exfiltrating data, and sometimes wiping systems with pseudo‑random data; they also use encryption and threaten to release decryption keys incrementally unless paid. Communications are conducted via email, Twitter, Pastebin, and direct media outreach, often providing proof‑of‑concept data samples. Notable operations include the 2017 extortion attempt against Netflix over unreleased Orange Is the New Black episodes, the 2018 breach of a law firm handling 9/11 litigation threatening to leak 18,000 files, the 2018 dump of roughly 180,000 patient records from multiple healthcare hacks, and the 2025 claim of stealing over 500 GB of Gorilla Glue intellectual property. No state affiliation or broader criminal consortium is publicly attributed to the group.
Incidents
Attributed incidents are available to members.
29 incidentsSources
Sources available to members: 23 sources.