Loading threat actor…
RADAR is a cybercriminal threat actor associated with both initial-access brokerage and ransomware activity. It has been identified as an Initial Access Broker (IAB) that obtains unauthorized access to victim environments and offers that access to other criminal operators, and it has also been named among newly emerged ransomware groups in 2025. Reported activity links RADAR to attacks against the real estate sector and to the sale of remote access into a Swiss company that was later associated with a RansomHub leak-site posting, indicating a role in enabling downstream extortion operations. As an IAB, RADAR fits the broader criminal model in which specialized actors compromise organizations, retain persistence, and monetize access by transferring it to ransomware affiliates or other follow-on operators. This tradecraft commonly involves compromising remote access pathways, obtaining credentials, mapping victim environments, and facilitating later intrusion stages by buyers. The available reporting directly supports RADAR’s involvement in selling remote desktop access and in targeting organizations in the real estate sector. RADAR appears to be financially motivated. Available information supports its role in access monetization and ransomware-linked operations, but does not provide high-confidence attribution to a specific state sponsor or country of origin.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cluster of attacks attributed to RADAR against real estate organizations in Oceania.
Radar is a newly emerged ransomware group active as of September 2025.
Initial Access Broker (IAB) that advertises/sells RDP access; example given of an apparent handoff where access sold preceded the victim appearing on a ransomware leak site (RansomHub).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.