Space Bears
Space Bears is a ransomware and extortion group first identified in April 2024. Multiple sources in the provided content associate it with the Phobos ransomware-as-a-service (RaaS) ecosystem, and one source states its leak site is believed to function as a shared publishing point for activity related to Phobos infrastructure. The group is described as a data-theft-and-extortion operation that sometimes deploys encryption but often focuses on exfiltrating sensitive files and threatening publication or sale if victims do not pay. The content also describes Space Bears as using a dedicated leak site with countdown timers, contact forms, and offers to sell stolen data to third parties. Reported targeting in the provided content spans telecommunications, managed services, manufacturing, and critical infrastructure-related organizations across multiple countries. Cited victims or claimed victims include Vertel in Australia, 3P Corporation in Australia, Texcomp in Saudi Arabia, Kymco in Taiwan, Quasar Inc. in Georgia, and Comcast-related material allegedly obtained via Quasar. One source explicitly characterizes Space Bears as focused on critical infrastructure and using stealthy encryption. The content also notes Space Bears activity against Korean and Japanese organizations, including two incidents attributed to the group in Japan in the first half of 2025 and inclusion among groups responsible for attacks on Korean companies in 2024. Observed extortion behavior in the provided content includes publishing victim entries on a leak site, setting deadlines for public release, claiming exfiltration of SQL databases and sensitive business data, and advertising stolen data for sale. Reported data types include client personal information, financial documents, patent and innovation data, customer and partner data, network project documents, city drawings, communication layouts, city design documentation, and detailed utility plans. The only alias directly provided in the content is "space_bears."
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
- Financial Services
- Government & Administration
- Health Care Equipment & Services
- Utilities
Where they target
Geographies tied to known operations.
- 🇦🇺 Australia
Tradecraft
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware/extortion group operating a leak site and using double extortion; assessed as associated with the Phobos RaaS ecosystem and linked to the ‘Faust’ operator within that ecosystem.
Ransomware group operating a leak site and using double extortion; assessed as associated with the Phobos RaaS ecosystem (including linkage to a 'Faust' operator per the report).
Space Bears is a ransomware group targeting telecommunications and engineering contractors, exfiltrating sensitive internal documents.
Data theft and extortion operation (sometimes encrypts, often focuses on exfiltration and threatening publication) operating via a dark web leak site; claims Comcast-related data was obtained via a third-party breach at Quasar Inc. and is running timed leak countdowns while offering the data for sale.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.