Loading threat actor…
Marak is a cybercriminal group linked by French authorities to intrusions against healthcare institutions, medical-sector companies, and a messaging service used by French customs. The group was investigated following the 2025 compromise of Hôpital privé de la Loire in Saint-Étienne. The intrusion involved impersonation or compromise of a physician account by exploiting weaknesses in authentication for dematerialized professional credentials, enabling access to electronic patient data. Authorities attribute the exfiltration of nearly four million patient records in total to the group’s activity. Five suspected members, aged 16 to 22, were arrested; three were subsequently indicted for offenses involving automated data-processing systems and placed under judicial supervision. An individual using the Marak alias also claimed responsibility for the hospital breach and reportedly attempted to sell stolen data. Marak’s confirmed operational behavior includes credential compromise or account abuse for initial access, access to sensitive medical information repositories, and large-scale data exfiltration.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.