Threat Landscape

Engages in software supply chain compromise attacks, injecting malicious code into software to exfiltrate sensitive secrets (e.g., cloud access tokens, SSH keys). Partners with RaaS and EaaS operators (e.g., LAPSUS$ Group, Vect ransomware) to monetize intrusions.

Targeted developers and the cryptocurrency ecosystem with social engineering schemes, including Operation DreamJob against European drone manufacturers and Operation DangerousPassword compromising the JavaScript library axios.

Individuals or small groups engaging in opportunistic fraud such as bonus abuse, chargeback disputes, and multi-accounting. Uses automation, shared data, and behavioral simulation to evade detection and blend into legitimate user activity.

Conducted quicker, opportunistic attacks targeting developers and the cryptocurrency ecosystem, aligned with North Korea.

Steals data and demands ransom; if the victim does not comply, the data is published or sold to the highest bidder. Known for targeting organizations to exfiltrate personal and sensitive information for extortion purposes.

Combines encryption with data theft and extortion in ransomware attacks targeting various organizations.

Conducted a large-scale poisoning campaign targeting Ghost CMS by exploiting CVE-2026-26980 to inject malicious JavaScript loaders into articles. The campaign involved automated bulk vulnerability scanning, Admin API key extraction, and dynamic C2 distribution to deliver malware such as stealer trojans via ClickFix social engineering attacks. The group used cloaking domains and updated payloads to evade detection and maintain persistence.

Operates the Gentlemen ransomware-as-a-service (RaaS) platform, managing the RaaS while affiliates carry out attacks. Uses double extortion tactics, encrypting data and exfiltrating sensitive information to pressure victims. Recently partnered with BreachForums to recruit affiliates and expand operations.

Infrastructure (workstation WIN-8OA3CCQAE4D) identified as being associated with Qilin ransomware operations, indicating potential collaboration or shared resources with other ransomware groups.

Targeted entertainment and hospitality organizations with ransomware campaigns, including attacks on reservations, digital keys, point-of-sale (PoS) machines, and loyalty data. Demonstrated capability to disrupt major hotel operators through social-engineering campaigns.

Conducted a large-scale supply chain attack on the npm ecosystem by compromising the 'atool' npm account, which owns popular packages like timeago.js. The attack involved publishing malicious versions of over 300 packages across Alibaba's AntV data visualization ecosystem, exfiltrating credentials, and establishing persistence via backdoors in developer tools like VS Code and Claude Code. The attacker used advanced techniques such as memory scraping to extract unmasked secrets from CI runners, GitHub API dead-drops for exfiltration, and OpenTelemetry impersonation for command and control (C2). The attack was well-orchestrated, with deliberate signaling via GitHub repository descriptions using Dune-universe terminology.

Exploits vulnerabilities (e.g., Oracle EBS) to conduct data theft and extortion, shifting away from ransomware encryption to pure extortion tactics.

Weaponized CVE-2026-21509 and CVE-2026-32202 in targeted spear-phishing campaigns delivering weaponized document attachments with high-fidelity institutional lures to Ukrainian government agencies and European defense, transportation, and diplomatic entities. Used multi-stage infection chains culminating in the NotDoor Outlook backdoor and Covenant Grunt implants, with cloud storage services as C2 infrastructure.

Engages in ransomware attacks involving encryption and data theft for extortion purposes.

Partners with TGR-CRI-1135 to monetize intrusions through ransomware-as-a-service (RaaS) operations, though recent forum removal may impact future collaborations.

Collaborates with TGR-CRI-1135 to extort organizations via data leak sites as part of extortion-as-a-service (EaaS) operations.

Developed and distributed the EvilTokens phishing-as-a-service toolkit, which automates device code phishing attacks at scale. The toolkit uses AI to generate realistic attack infrastructure and lowers victim friction through responsive design and automated device code generation.

Develops and deploys malware targeting Israeli water infrastructure, including ZionSiphon, which is designed to sabotage water treatment systems. The group is associated with Iranian cyber activity and exhibits tradecraft consistent with mid-tier Iranian state-aligned operations.

Ransomware operators providing ransomware-as-a-service (RaaS), maintaining the ransomware variant, infrastructure, and managing ransom negotiations. Affiliates deploy the ransomware in victim environments.

Executed significant wiper attacks in early 2026, targeting high-level government officials, doxxing employees of public companies, and conducting disruptive operations against U.S. critical infrastructure, including internet-exposed PLCs in water, energy, and municipal services.