Loading threat actor…
GS7 is a financially motivated cybercriminal threat actor associated with large-scale phishing and brand-impersonation operations, most notably Operation DoppelBrand. The actor has targeted Fortune 500 companies and their customers, with a strong emphasis on major financial institutions and additional activity against technology, healthcare, telecommunications, insurance, and investment-sector organizations. Reported victimology shows a primary focus on English-speaking markets, especially the United States, while also indicating broader global targeting and activity in Western Europe. GS7’s tradecraft centers on high-fidelity credential-harvesting portals that closely mimic legitimate enterprise and consumer login pages. The actor has operated extensive and frequently rotated phishing infrastructure, including large volumes of lookalike domains, automated registration patterns, and traffic proxying or CDN fronting to hinder attribution and takedown. Collected victim data has included usernames, passwords, and contextual telemetry such as device, browser, and geolocation information, with exfiltration routed through attacker-controlled Telegram bots and channels. Beyond phishing, GS7 has been linked to post-compromise deployment of legitimate remote monitoring and management tools to establish persistent remote access on victim systems. Reported tooling and delivery methods indicate use of scripted loaders and installer-based deployment flows, including privilege-elevation attempts and cleanup steps intended to reduce forensic visibility. This combination of credential theft, remote access enablement, and infrastructure rotation reflects a mature initial-access operation rather than a simple phishing crew. GS7 is widely assessed as functioning as an initial access broker, monetizing harvested credentials and compromised access through underground markets and Telegram-based channels, and potentially enabling follow-on intrusion activity by other criminal actors, including ransomware affiliates. Reporting also links the actor to Brazilian cybercrime forums and credential-trading ecosystems, but no high-confidence country of origin has been established. Known aliases in the available reporting are limited to GS7 and GS.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.