Loading threat actor…
HexDex is a francophone cybercriminal threat actor associated with a concentrated wave of data-breach and data-sale activity targeting French organizations in late 2025 and early 2026. The actor was identified as one of the most prolific names in underground leak and sale postings affecting France, with observed activity focused exclusively on French victims during the referenced period. French authorities later arrested a 20-year-old suspect in western France who allegedly used the HexDex alias, admitted claiming responsibility for intrusions, and published stolen data on cybercrime forums. HexDex’s operations are characterized primarily by theft, exfiltration, and monetization of stolen data rather than ransomware deployment or disruptive attacks. Reported victims span French public institutions, sports federations, retail and e-commerce businesses, hospitality organizations, cultural institutions, and healthcare-related services. Publicly attributed incidents include alleged breaches involving the French Basketball Federation, Therapeutes.com, Airsoft-Entrepot, and Allopneus, as well as broader suspected targeting of multiple French sports bodies and government-related systems. The actor has been linked to the sale or publication of large datasets containing personal information, customer records, appointment data, operational business records, and other sensitive information. Observed tradecraft is consistent with intrusion into internet-exposed services and subsequent collection of data from internal repositories, followed by exfiltration and advertisement of the stolen material through underground forums and messaging platforms. ATT&CK mappings associated with HexDex-linked incidents include exploitation of public-facing applications, use of valid accounts in at least one reported case, collection from information repositories and cloud storage, harvesting of identity data, and exfiltration over web services. The actor’s behavior aligns with opportunistic, reputation-driven cybercrime in which visibility and notoriety appear to be significant drivers alongside financial gain. HexDex is assessed as originating from France at high confidence based on arrest reporting and attribution context. The actor is notable for repeatedly targeting French entities across multiple sectors and for participating in a broader francophone underground ecosystem that heavily emphasized French victims during the period. No high-confidence evidence directly ties HexDex to ransomware operations, state sponsorship, or hacktivist activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Identified as a notable actor in the surge, publishing exclusively posts targeting French entities and assessed as originating from France.
Leading actor by number of claims in the sample; activity during the period was exclusively focused on alleged data leaks affecting French targets.
Allegedly responsible for dozens of data breaches in France, claiming responsibility for hacks and publishing stolen data on cybercrime marketplaces including BreachForum and Darkforum. Targets included public institutions, sports federations, private organizations, and government databases.
Conducting data breach and data sale operations targeting French organizations, including the French Basketball Federation, and monetizing stolen personal data.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.