Daixin Team — Ransomware Profile
Daixin Team is a financially motivated extortion crew that US agencies profiled in the joint FBI/CISA/HHS advisory AA22-294A of October 2022, which traces its activity to at least June 2022 and highlights a heavy focus on the American Healthcare and Public Health sector. Per that advisory, the group typically gains entry through unpatched or credential-compromised VPN servers, pivots to VMware ESXi infrastructure, and encrypts servers supporting electronic health records, diagnostics and imaging. Its best-known victim outside healthcare was AirAsia, whose passenger and employee records the group claimed in November 2022 according to contemporaneous reporting. The crew continues to operate a data-leak site.Also tracked as
Daixin