Loading threat actor…
Revolut Smilik is an online alias associated with the initial publication of purported Revolut customer data following a 2026 social-engineering incident involving fraudulent customer-information requests sent through an Italian institutional certified-email channel. The alias threatened further disclosures while demanding payment from Revolut, indicating an apparent financially motivated data-extortion operation. A separate group using the name iamnotavillain publicly disputed the alias’s role and asserted that Revolut Smilik was either an impersonator or former associate; this relationship is unverified. Attribution of the broader intrusion, claimed data holdings, and operational role of Revolut Smilik remains unconfirmed.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A purported former associate of iamnotavillain linked to initial online publication of stolen Revolut customer data and threats to continue leaking it unless Revolut paid. This claimed relationship is not independently confirmed.
Associated with an earlier alleged ransom demand involving the Revolut breach. Its relationship to iamnotavillain and possession of stolen data remain unverified.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.