Loading threat actor…
ShadowSyndicate is a cybercrime cluster active since at least 2022 and publicly tracked since 2023. It is best understood as a multi-role criminal enablement actor rather than a single, stable ransomware brand. Reporting consistently links it to infrastructure used across numerous ransomware operations and malware ecosystems, with strong associations to Quantum, Nokoyawa, and ALPHV/BlackCat activity, and additional lower-confidence ties to Royal, Cl0p, Cactus, Play, LockBit, Black Basta, Ryuk, RansomHub, and other criminal tooling clusters. ShadowSyndicate has also been described as an affiliate across multiple ransomware-as-a-service programs and as a likely Initial Access Broker or bulletproof-hosting-style infrastructure provider. The actor is notable for operating a large, reusable server estate and for persistent infrastructure tradecraft, including continued use of OpenSSH, repeated SSH markers and access keys, and overlap across clusters of command-and-control servers. Its infrastructure has been observed supporting open-source post-exploitation frameworks and offensive tooling such as Cobalt Strike, Metasploit, Havoc, Mythic, Sliver, Brute Ratel, and MeshAgent, as well as malware families including TrueBot and AMOS Stealer. Multiple reports describe ShadowSyndicate-linked servers functioning as command-and-control nodes, OpenVPN endpoints, and staging systems that are later reused or repurposed across different criminal campaigns. Operationally, ShadowSyndicate appears to specialize in enabling downstream intrusions rather than exclusively conducting end-to-end ransomware operations under one banner. It has been linked to scanning for exploitable internet-facing systems, including activity targeting CVE-2024-23334, and to infrastructure overlaps with campaigns involving Citrix Bleed exploitation. Reporting also places the cluster in ecosystems associated with credential-based access, brute-force activity, remote administration tooling, and post-compromise staging. Its repeated association with many unrelated ransomware families over time strongly suggests an access-brokering, affiliate, or shared-services role inside the broader eCrime market. ShadowSyndicate has been observed using at least seven ransomware families over a period of years and has been specifically identified as an affiliate of the ALPHV/BlackCat operation. It has also been linked to RansomHub usage. These associations indicate participation in financially motivated extortion ecosystems, but the exact boundaries of the group’s role remain unresolved. The most defensible characterization is that ShadowSyndicate is a financially motivated cybercrime cluster that provides or brokers access and infrastructure to ransomware operators while also participating directly as an affiliate in multiple ransomware campaigns.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
14 malware families attributed to this actor across reporting.
9 additional families tracked in Mallory.
39 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as one of several groups linked via Cobalt Strike watermark analysis on BitLaunch infrastructure.
A cybercrime activity cluster that has expanded and maintained coordinated SSH-based infrastructure (reused access keys, consistent OpenSSH usage) and operates servers used as C2 nodes for open-source post-exploitation tools and red team frameworks; assessed as potentially functioning as an Initial Access Broker and/or a bulletproof hosting provider.
Cybercrime activity cluster operating shared/reused infrastructure (SSH-keyed server clusters) that supports multiple downstream threat clusters; associated with a broad post-exploitation toolkit and infrastructure handoffs between SSH clusters.
Mentioned only as an additional threat cluster seen in overlapping/shared subnet infrastructure; no further details provided.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.