About this actor
Daixin is a threat actor group that has been active since at least June 2022. They primarily target the healthcare and public health sector with ransomware attacks, stealing sensitive data and threatening to release it if a ransom is not paid. They have successfully targeted various industries, including healthcare, aerospace, automotive, and packaged foods. Daixin gains initial access through VPN servers and exploits vulnerabilities or uses phishing attacks to obtain credentials. They have been responsible for cyberattacks on organizations such as the North Texas Municipal Water District and TransForm Shared Service Org, impacting their networks and stealing customer and patient information.
How we know this
- Data origin
- MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
- Techniques
- No ATT&CK techniques mapped.
- Named victims
- 2 extracted from reporting.
Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.
See how actor data is built for the full pipeline.
Activity timeline
- 2023 — 2 CVE published, 1 KEV added
- 2022 — 1 KEV added
- 2021 — 1 CVE published, 1 KEV added
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2021-44228 KEV | 10.0 | 10.0 | 1.0000 | 2021-12-10 | see CVE |
CVE-2022-42475 KEV | 9.9 | 9.8 | 0.9947 | 2023-01-02 | see CVE |
CVE-2022-47966 KEV | 9.9 | 9.8 | 0.9975 | 2023-01-18 | see CVE |
No techniques attributed.
Co-occurring actors
- COMP-MICROSOFT-SALESFORCE 3 shared CVEs
- AnonOps 3 shared CVEs
- COMP-GOOGLE-CIVIL-DEFENDANT 3 shared CVEs
- COMP-SK-INNOVATION 3 shared CVEs
- l group 2 shared CVEs
- Storm-0530 2 shared CVEs
- Maui ransomware 2 shared CVEs
- COMP-APPLE-MASIMO 2 shared CVEs
- Lazarus Group 2 shared CVEs
- Clop 2 shared CVEs
Similar actors
Overlapping CVEs
- COMP-SK-INNOVATION 1.00
- COMP-CONTINENTAL-BOSCH 0.33
- Karakurt 0.33
- HiddenTear 0.20
- Evil Ransomware 0.20