TeamHood 
The DarkTracer Threat intelligence group has reported that a new ransomware threat going by the name of “HARON” has opened a leak blog in the Darknet. Their darkweb blog of the HARON has the same layout and design as the of the Avaddon ransomware gang. It is noted that Avaddon gang is not operational since June 2021.
The DarkTracer then mentioned that the gang is pressuring the victims by mentioning that they have already received the purchase offers from the Darkweb Leak Market and if they did not pay the ransom in time they will sold the data.
Instead of using emails to contact the victims, the gangs are asking victims to visit a TOR-based payment page. Victims are also provided with a login and password that will work on the TOR-hosted website. Allegedly, victims need to follow the instructions hosted there it get their data back. The criminals state that victims have three days to pay before they start publishing the contents of their data online
