DarkGaboon, a financially motivated cybercrime group, has been targeting Russian companies across various sectors, including banking, retail, tourism, and public services, with a series of ransomware attacks. Initially identified by researchers in January, DarkGaboon’s operations trace back to 2023. In its recent spring campaign, DarkGaboon has deployed LockBit 3.0 ransomware against Russian victims. This version of LockBit, publicly leaked in 2022, is widely used by cybercriminals, but DarkGaboon operates independently rather than as part of the ransomware-as-a-service (RaaS) model typical of LockBit affiliates. DarkGaboon’s attacks begin with phishing emails written in Russian, targeting financial department employees with urgent messages and malicious attachments disguised as legitimate financial documents. The lure documents are based on templates from legitimate Russian-language sources and have remained consistent since 2023. Upon breaching a victim’s network, DarkGaboon encrypts files using LockBit 3.0 and leaves a ransom note in Russian, listing contact email addresses. Researchers found no evidence of data exfiltration in recent incidents. Notably, the email addresses in the ransom notes were linked to previous LockBit attacks on Russian financial institutions in early 2023. While the individuals behind DarkGaboon remain unidentified, they are believed to be fluent in Russian. The group employs open-source tools like Revenge RAT, XWorm, and LockBit ransomware to blend in with the broader cybercriminal landscape, complicating attribution efforts. LockBit ransomware variants have previously targeted Russian entities. In December, hackers used it to attack the largest dairy processing plant in southern Siberia shortly after the company provided humanitarian aid for Russian soldiers in Ukraine. However, no specific threat actor has been attributed to that attack.