Daixin Team

Profile narrative

Daixin Team, also known simply as Daixin, is a ransomware group that has been observed operating from Russia and has claimed responsibility for a series of attacks targeting critical infrastructure and commercial entities across multiple regions. The group’s victims have included a North Texas municipal water district, healthcare systems in Ohio and Texas, a multinational food producer based in California, an airline in Malaysia, a European IoT‑focused company, and various medical centers in the United States, demonstrating a pattern of targeting sectors such as utilities, health care, food manufacturing, aviation, and technology services. Their stated objective appears to be financial gain, as they routinely demand ransom payments, negotiate for reduced amounts to prevent data leaks, and threaten to publish stolen information when extortion attempts fail, while also claiming to avoid encrypting systems that could cause life‑threatening disruption in order to limit collateral harm.

In terms of tactics, Daixin Team gains initial access through unpatched VPN, SSH, and RDP services, often starting from an unprivileged user account that they escalate to full administrative control across multiple domains. Once inside, they disable security features, block administrator accounts, and encrypt both production servers and backups, sometimes noting that encryption can continue even after they go offline. The group employs a ransomware payload that encrypts files and exfiltrates data, which they subsequently leak on a dark web site if the victim does not meet their demands, as seen in the B&G Foods, OakBend Medical Center, and ista International incidents. They communicate with victims via notes left on the local network and chat channels, offering proof of data theft and negotiating ransom amounts before proceeding to public disclosure. Public attribution to a specific state sponsor or criminal consortium has not been established in the available sources, with the group’s location in Russia being the only geographic detail explicitly mentioned. Representative campaigns include the ransomware attack on AirAsia that compromised over five million passenger and employee records, the encryption of thousands of servers and petabytes of data at ista International, and the targeting of Columbus Regional Healthcare System where backups were deleted and a multi‑million‑dollar ransom was demanded. These incidents illustrate the group’s reliance on exploiting weak remote‑access configurations, their focus on data exfiltration for extortion, and their tendency to avoid disrupting essential operational technology while still seeking financial profit.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 4 sources.