Threat Landscape

Engages in software supply chain compromise attacks, injecting malicious code into software to exfiltrate sensitive secrets (e.g., cloud access tokens, SSH keys). Partners with RaaS and EaaS operators (e.g., LAPSUS$ Group, Vect ransomware) to monetize intrusions.

Targeted developers and the cryptocurrency ecosystem with social engineering schemes, including Operation DreamJob against European drone manufacturers and Operation DangerousPassword compromising the JavaScript library axios.

Infrastructure (workstation WIN-8OA3CCQAE4D) identified as being associated with Qilin ransomware operations, indicating potential collaboration or shared resources with other ransomware groups.

Steals data and demands ransom; if the victim does not comply, the data is published or sold to the highest bidder. Known for targeting organizations to exfiltrate personal and sensitive information for extortion purposes.

Combines encryption with data theft and extortion in ransomware attacks targeting various organizations.

Deployed Covenant and BeardShell implants against Ukrainian military personnel, drone manufacturers, and organizations involved in drone research and development, as well as logistics and transportation companies outside Ukraine. Russia-aligned group.

Individuals or small groups engaging in opportunistic fraud such as bonus abuse, chargeback disputes, and multi-accounting. Uses automation, shared data, and behavioral simulation to evade detection and blend into legitimate user activity.

Executed significant wiper attacks in early 2026, targeting high-level government officials, doxxing employees of public companies, and conducting disruptive operations against U.S. critical infrastructure, including internet-exposed PLCs in water, energy, and municipal services.

Conducted a large-scale poisoning campaign targeting Ghost CMS by exploiting CVE-2026-26980 to inject malicious JavaScript loaders into articles. The campaign involved automated bulk vulnerability scanning, Admin API key extraction, and dynamic C2 distribution to deliver malware such as stealer trojans via ClickFix social engineering attacks. The group used cloaking domains and updated payloads to evade detection and maintain persistence.

Develops and deploys malware targeting Israeli water infrastructure, including ZionSiphon, which is designed to sabotage water treatment systems. The group is associated with Iranian cyber activity and exhibits tradecraft consistent with mid-tier Iranian state-aligned operations.

Ransomware operators providing ransomware-as-a-service (RaaS), maintaining the ransomware variant, infrastructure, and managing ransom negotiations. Affiliates deploy the ransomware in victim environments.

Operates the Gentlemen ransomware-as-a-service (RaaS) platform, managing the RaaS while affiliates carry out attacks. Uses double extortion tactics, encrypting data and exfiltrating sensitive information to pressure victims. Recently partnered with BreachForums to recruit affiliates and expand operations.

Developed and distributed the EvilTokens phishing-as-a-service toolkit, which automates device code phishing attacks at scale. The toolkit uses AI to generate realistic attack infrastructure and lowers victim friction through responsive design and automated device code generation.

Conducted a large-scale supply chain attack on the npm ecosystem by compromising the 'atool' npm account, which owns popular packages like timeago.js. The attack involved publishing malicious versions of over 300 packages across Alibaba's AntV data visualization ecosystem, exfiltrating credentials, and establishing persistence via backdoors in developer tools like VS Code and Claude Code. The attacker used advanced techniques such as memory scraping to extract unmasked secrets from CI runners, GitHub API dead-drops for exfiltration, and OpenTelemetry impersonation for command and control (C2). The attack was well-orchestrated, with deliberate signaling via GitHub repository descriptions using Dune-universe terminology.

Collaborates with TGR-CRI-1135 to extort organizations via data leak sites as part of extortion-as-a-service (EaaS) operations.

Targeted entertainment and hospitality organizations with ransomware campaigns, including attacks on reservations, digital keys, point-of-sale (PoS) machines, and loyalty data. Demonstrated capability to disrupt major hotel operators through social-engineering campaigns.

Partners with TGR-CRI-1135 to monetize intrusions through ransomware-as-a-service (RaaS) operations, though recent forum removal may impact future collaborations.

Exploits vulnerabilities (e.g., Oracle EBS) to conduct data theft and extortion, shifting away from ransomware encryption to pure extortion tactics.

Engages in ransomware attacks involving encryption and data theft for extortion purposes.

Targeted industrial-control systems (ICS) and operational technology (OT), including PLCs in U.S. critical infrastructure such as water, wastewater, and energy sectors. Documented escalation in targeting municipal infrastructure relevant to the World Cup host cities.