Trending Adversaries

N0n is a financially motivated threat group associated with ransomware attacks and data-extortion demands against organizations across multiple countries. Its identified targets prominently include container shipping companies, logistics providers, port operators, and container terminals. Other targets include technology and smart-building integration companies, architecture and design firms, healthcare providers, and financial-services organizations. The group uses threats to publish compromised data by specified deadlines to pressure victims into paying ransom demands. Data associated with its maritime and logistics attacks includes electronic data interchange archives, container manifests, booking records, vessel schedules, gate movements, commercial tariff documentation, terminal deployment and configuration records, internal database scripts, and credential material. Announced publication deadlines do not establish that the data has actually been released. The group's geographic origin, initial-access techniques, ransomware family, encryption methods, and organizational structure are not established.

Interlock is a financially motivated ransomware and data-extortion group first observed in September 2024. Also known as Interlock ransomware or the Interlock ransomware gang, it conducts double-extortion attacks that combine theft of sensitive information with system encryption and threats of publication on a dedicated leak site. Its targets include healthcare providers, educational institutions, government organizations, manufacturers, contractors, and defense-sector organizations, with a predominantly United States focus. Attacks against DaVita and Kettering Health caused significant healthcare operational disruption. No nation-state sponsorship or country of origin has been established. Interlock obtains initial access through compromised websites, counterfeit browser and VPN updates, trojanized installers, and ClickFix social engineering that induces users to execute malicious commands. An intrusion exploiting CVE-2026-20131 demonstrates its use of network-edge vulnerabilities for initial access. Its infection chains have been linked to the TAG-124 traffic distribution system, although an organizational relationship between the operators has not been established. The group uses credential stealers, keyloggers, PowerShell backdoors, and custom remote-access malware, including Interlock RAT and NodeSnake. A Node.js-based Interlock RAT variant executes malicious JavaScript through a legitimate signed runtime, supports SOCKS proxying, fingerprints compromised hosts, and enumerates Active Directory users, privileged groups, domain trusts, and potential backup servers. Persistence mechanisms include scheduled tasks, startup shortcuts, and user-level autorun entries. Obfuscation, living-off-the-land techniques, and abuse of legitimate software help conceal malicious activity. Interlock uses remote-access and administrative tools for continued access and lateral movement, and cloud-storage utilities for data exfiltration. Its ransomware targets Windows and Unix-like environments, including virtualized infrastructure. Operations have included weekend encryption deployments intended to take advantage of reduced staffing. Stolen medical, employee, financial, and proprietary business information provides additional leverage for ransom demands.

ShinyHunters is a financially motivated cybercriminal collective focused on stealing sensitive information and extorting organizations through threats of public disclosure. Also styled Shiny Hunters or ShinyHunter, it is associated with the tracking designations Bling Libra, UNC6040 and UNC6240. Its targeting includes healthcare companies, government organizations, technology providers and higher education institutions. The collective commonly obtains login credentials through phishing and abuses compromised accounts to extract information from cloud software services, including Salesforce environments. It also exploits cloud misconfigurations and vulnerable enterprise applications. Its extortion model centers on demanding payment to prevent publication of stolen records, rather than requiring file encryption. ShinyHunters operates data-leak sites and publishes victim information to support these demands. In August 2026, ShinyHunters conducted a pay-or-leak campaign against digital health company Sharecare and subsequently published a dataset containing approximately 318,000 unique email addresses. The exposed information predominantly comprised business sales and marketing records, with additional personal information concerning Brazilian health insurance members. The collective has also targeted the FBI's third-party recruitment platform and listed Ernst & Young on its data-leak site. Its operations have prompted an international law-enforcement investigation and arrests of suspected associates.

Qilin is a financially motivated, Russian-speaking ransomware-as-a-service operation that emerged in August 2022 under the name Agenda. It is also tracked as GOLD FEATHER and Water Galura. The operation enables affiliates to deploy customized ransomware payloads and conducts double-extortion attacks, stealing data before encrypting victims’ systems and threatening to publish stolen information on Tor-based leak portals. Qilin targets organizations internationally across healthcare, manufacturing, financial services, technology, professional services, transportation, energy, hospitality, education, government, and media. Notable victims include Japanese companies Nissan and Asahi, U.S. newspaper publisher Lee Enterprises, and Australia’s Court Services Victoria. Its attacks have caused substantial operational disruption, including prolonged interruption of Asahi’s order processing, shipping, and customer services. The operation remained highly active through 2025 and 2026. Initial-access methods include phishing and exploitation of vulnerabilities in internet-facing remote-access infrastructure. Qilin has exploited CVE-2026-0257, an authentication-bypass vulnerability affecting Palo Alto Networks GlobalProtect and Prisma Access, to establish unauthorized VPN sessions. Intrusions have progressed from VPN access to credential theft and ransomware deployment. Associated activity includes the use of Cobalt Strike, BloodHound, and SharpHound for post-exploitation and internal reconnaissance. Use of victims’ legitimate VPN infrastructure can make malicious access resemble ordinary remote-work traffic. Qilin combines data theft, encryption, and public leak threats to pressure victims into paying ransom.

Dark Project is a ransomware threat group associated with attacks against organizations primarily in the United States, with additional victims in Brazil and the Philippines. Its targets include industrial manufacturers, architecture and engineering firms, accounting and staffing businesses, logistics providers, retailers, hospitality companies, and healthcare practices. The group's operations involve theft of confidential business information and encryption of victim systems. Attacks against an accounting firm and a moving and logistics company involved data exfiltration followed by encryption, causing substantial operational disruption. Across its victims, stolen information has included customer and employee personal data, financial and banking records, internal business documents, architectural drawings, engineering schematics, and other proprietary project information. Multiple incidents have involved substantial data theft, including hundreds of gigabytes of sensitive material. Dark Project's country of origin, organizational structure, initial-access methods, and specific ransomware tooling have not been established.

Play, also known as Playcrypt and Balloonfly, is a financially motivated ransomware and extortion group active since at least June 2022. It targets organizations across North America, South America, and Europe, including manufacturing, healthcare, education, technology, financial services, professional services, food production, hospitality, and government entities. Known victims include Rackspace, Germany’s H-Hotels hotel chain, the Belgian city of Antwerp, and Argentina’s Judiciary of Córdoba. Play primarily operates as a closed organization with relatively consistent intrusion techniques rather than a broadly accessible affiliate program. Play gains initial access through compromised valid accounts, including VPN and RDP accounts, and exploitation of internet-facing systems. Its documented exploitation includes FortiOS vulnerabilities CVE-2018-13379 and CVE-2020-12812 and Microsoft Exchange vulnerabilities. In the Rackspace intrusion, Play used OWASSRF exploitation involving CVE-2022-41080 to bypass ProxyNotShell URL rewrite mitigations. Its intrusion tooling includes SystemBC for command and control and sustained access, Mimikatz for credential theft, and PsExec for lateral movement and ransomware distribution. Operators enumerate virtualization infrastructure and network shares, stage stolen information with WinRAR, and exfiltrate data using WinSCP or FTP. Documented defense-evasion techniques include removing SentinelOne with the victim’s legitimate SentinelCleaner utility and clearing Windows Security logs. Attackers have maintained access for approximately two and a half months before encryption. Play uses double extortion, stealing sensitive information before encrypting systems and threatening publication through a Tor-hosted leak site. Stolen information has included accounting records, budgets, human-resources documents, client information, and bank statements. Ransom notes direct victims to contact the operators, and some victims receive follow-up telephone calls encouraging payment.

Orova is a ransomware and data-extortion group active in 2026, with reported victims in Hong Kong, Taiwan, India, and the United States. Its reported targets span technology, manufacturing, hospitality, healthcare, professional services, property development, and energy and utilities. Named victims include Libre Wireless Technologies, Amantya Technologies, ASYS Corporation, The Park Lane Hong Kong, South Pacific Hotel Limited, ITC Properties Group Limited, and Cardiology Associates of Port Huron. Orova operates a public leak site where it identifies victims and publishes samples of purportedly stolen information to support extortion. Its activity includes theft of sensitive organizational and personal data and claims of server encryption, consistent with double-extortion operations. In the Cardiology Associates of Port Huron case, independent examination of material made available by Orova identified substantial patient information, including clinical records, insurance and claims information, personal identifiers, and radiology images. Orova claimed approximately 496 GB of stolen data and threatened to release the password for an archive hosted through its leak site. Its encryption claim in that incident was not independently confirmed. Orova posted 35 victim claims during the week of August 3–9, 2026; these claims do not establish 35 independently verified compromises. Its country of origin, organizational structure, initial-access methods, and ransomware payload have not been established.

MetaEncryptor, also styled Metaencryptor or metaencryptor, is a ransomware threat group associated with claimed compromises of organizations in the United States, Japan, South Korea, Canada, Indonesia, and Singapore. Its claimed targets span healthcare, technology services, industrial manufacturing, engineering and construction, automotive components, steel production, energy equipment, accounting and professional services, and defense engineering. Victim listings dated September–October 2026 include MyMichigan Health, VIATechnik, GE Vernova, Astemo, Flex, Bruker, AECOM, Nippon Steel, EllisDon, SFA Engineering, and ST Engineering. The group recorded nine compromise claims during September 21–27, 2026. These claims do not establish independently confirmed compromises or technical attribution. Its initial-access methods, malware implementation, encryption behavior, data-exfiltration practices, and extortion mechanisms are not established. Its operational origin and any state affiliation are also not established.

Akira is a financially motivated ransomware-as-a-service operation active since March 2023. It is also tracked as GOLD SAHARA, HOWLING SCORPIUS, PUNK SPIDER, and Storm-1567. PUNK SPIDER identifies the adversary responsible for developing and maintaining Akira ransomware and its dedicated data-leak site. The operation targets small and medium-sized businesses as well as larger enterprises and critical infrastructure organizations across North America, South America, Europe, Australia, and other regions. Targeted sectors include manufacturing, professional services, construction, healthcare, education, financial services, retail, telecommunications, and government. Akira uses double extortion, stealing sensitive information before encrypting systems and threatening to publish stolen data. Its operators and affiliates obtain initial access through compromised or purchased credentials, brute-force attacks, exposed Remote Desktop Protocol services, spearphishing, and VPN services lacking multifactor authentication. Documented exploitation includes Cisco ASA and Firepower Threat Defense vulnerabilities CVE-2020-3259 and CVE-2023-20269. Post-compromise activity includes reconnaissance, credential dumping, lateral movement, and data exfiltration using custom malware and publicly available tools, including Mimikatz, Masscan, and Rclone. The ransomware portfolio includes the original C++-based Akira, the Rust-based Megazord variant observed from August 2023, and Akira_v2. The operation expanded to Linux and VMware ESXi in 2023. Akira-associated ransomware has also been used to encrypt files remotely over SMB shares from unmanaged systems without placing the ransomware executable on the target endpoints. By April 2024, authorities reported more than 250 affected organizations and approximately $42 million in ransom proceeds; these are historical figures rather than current totals.

The Gentlemen is a financially motivated ransomware-as-a-service operation that emerged in July 2025. Also known as Gentlemen and The Gentleman, its operators are tracked by Microsoft as Storm-2697. The operation combines sensitive-data theft, system encryption, and threats to publish stolen information through a leak site. It targets organizations internationally, with substantial activity in Europe, particularly the United Kingdom and Germany. Targets span industrial manufacturing, information technology, financial services, consumer-facing businesses, energy, and defense. Its affiliate ecosystem also conducts intrusions against logistics, insurance, pharmaceutical, medical-device, and artificial-intelligence organizations. Initial-access methods include exploitation of CVE-2024-55591 and other vulnerable edge devices, as well as stolen or purchased VPN credentials. The Go-based Windows encryptor uses Garble obfuscation, Curve25519 key exchange, and XChaCha20 encryption. It supports propagation to additional systems using available credentials and authentication tokens. Operators maintain security-disabling tools, including the internally developed GentleKiller framework. Intrusion techniques include remote execution, scheduled-task persistence, privileged-account creation, credential collection, security-service disruption, and data exfiltration. The operation also uses AI models for ransom negotiations and stolen-data triage. Azazel is a documented affiliate who obtained access through credentials exposed in GitLab pipeline variables and repository history, conducted reconnaissance and data theft, and integrated remote command execution into an AI coding assistant through Model Context Protocol. Azazel also maintained an independent data-leak and extortion operation and retained proceeds outside the operator's revenue-sharing arrangement. The Gentlemen has additionally demanded payments from clients of an already-extorted organization, extending pressure beyond the original victim.

SafePay is a financially motivated ransomware and extortion group, also referred to as the SafePay ransomware gang, group, or team. It lists victim organizations on dedicated leak sites, including healthcare entities. Its reported targeting spans multiple countries, with substantial representation in Germany and the United States, alongside victims in Italy, Switzerland, Spain, and other jurisdictions. SafePay's reported victims include construction and infrastructure businesses, architectural and professional-services firms, technology providers, industrial automation companies, manufacturers, retailers, hospitality businesses, agricultural enterprises, healthcare organizations, and municipal government. This victim distribution indicates broad cross-sector targeting rather than a narrowly defined industry focus. Individual victim listings are claims and do not necessarily establish independently confirmed compromises. Its operational base, organizational structure, initial-access techniques, and specific intrusion tooling are not established. Available incident details do not establish encryption or data exfiltration sufficiently to characterize its operations as double extortion.

INC Ransom, also known as INC, INC Ransomware, and GOLD IONIC, is a financially motivated ransomware-as-a-service operation active since 2023. Its core operators maintain the ransomware platform, while affiliates conduct intrusions in exchange for a share of ransom payments. The operation targets organizations internationally, with healthcare particularly prominent alongside government, education, technology, professional services, and grocery retail. Known targets include NHS organizations in the United Kingdom, healthcare entities in Australia and New Zealand, Tonga’s Ministry of Health, the Pennsylvania Office of the Attorney General, Panama’s Ministry of Economy and Finance, and Ahold Delhaize’s U.S. network. Its country of origin is not established. Affiliates obtain initial access through spearphishing, stolen or purchased credentials, attacks against exposed remote-access services, and exploitation of vulnerable perimeter systems. Documented vulnerabilities include CVE-2023-3519 and CVE-2023-4966 in Citrix NetScaler, CVE-2023-48788 in Fortinet endpoint management software, and CVE-2024-57727 in SimpleHelp. CitrixBleed exploitation enables authenticated-session hijacking and multifactor-authentication bypass. INC affiliates also use compromised Fortinet credentials supplied through the FortiBleed access ecosystem. Post-compromise activity includes network and account discovery, credential dumping, privilege escalation, and lateral movement using Impacket, Windows Management Instrumentation, PsExec, SMB, and pass-the-hash techniques. Persistence mechanisms include administrator accounts, services, scheduled tasks, and remote-management software. Affiliates abuse legitimate administrative tools, encode commands, clear event logs, disguise executables, and interfere with security controls. Stolen information is archived or divided into smaller transfers and exfiltrated using tools including Rclone, MegaSync, and Restic. INC maintains Windows and Linux ransomware variants and typically combines encryption with threats to publish stolen information on its data-leak site. It also conducts encryption-free data-theft extortion. Ransom demands may be distributed through compromised network printers. Microsoft tracks a significant affiliate using INC ransomware as Vanilla Tempest; that affiliate is distinct from the overall INC operation. Lynx is a related ransomware operation with reported development links to INC, rather than an interchangeable alias.

DragonForce, also known as Dragon Force, DragonForce Ransomware Cartel, and Slippery Scorpius, is a financially motivated ransomware operation identified in 2023. It adopted a ransomware-as-a-service model in 2024 and announced a cartel model in March 2025, allowing affiliates to operate under their own branding while using shared ransomware and infrastructure. Its geographic origin has not been established. DragonForce provides customizable payloads, administrative panels, victim negotiation and publication portals, storage, and operational support, offering partners an 80% share of proceeds. DragonForce targets organizations internationally, including manufacturing, construction, technology, healthcare, retail, transportation, financial services, telecommunications, education, and public-sector organizations. Its operations combine data theft and encryption with threats to publish stolen information through dedicated leak infrastructure. Its ransomware includes variants derived from leaked LockBit 3.0 and Conti code and supports Windows, Linux, and VMware ESXi environments, with configurable full and partial encryption. DragonForce campaigns use phishing, compromised credentials, exposed remote-access services, and exploitation of known vulnerabilities. A documented campaign exploited SimpleHelp vulnerabilities CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728 to compromise a managed service provider and distribute malicious software into downstream customer environments. Associated activity included credential harvesting, network reconnaissance, lateral movement, exfiltration, and ransomware deployment through legitimate remote-management infrastructure. Other techniques include scheduled tasks, legitimate administration tools, security-tool interference, event-log clearing, timestomping, and anti-analysis checks. DevMan has operated as a DragonForce affiliate. DragonForce also aggressively recruits access operators and penetration testers through criminal forums and has defaced competing ransomware operations' leak sites. In September 2025, it announced a coalition with Qilin and LockBit; the announcement does not establish operational integration.

DeadLock, also styled Deadlock, is a financially motivated ransomware operation first observed in July 2025. It conducts double extortion by encrypting victim environments, exfiltrating data, and threatening public disclosure through its leak blog. Its victims span Europe, Asia, North America, South America, and Africa, with a majority of claimed victims in Europe. Targeted sectors include information technology, mining, transportation and logistics, manufacturing, hospitality, consumer goods, healthcare, and telecommunications. Multiple threat actors have deployed DeadLock, including an affiliate previously associated with the Lynx and INC ransomware ecosystems; these associations do not establish that those operations are aliases of DeadLock. DeadLock uses decentralized infrastructure for victim communications, negotiations, and data disclosure. A victim-facing HTML application retrieves a replaceable messaging-proxy address from a Polygon smart contract and relays encrypted communications through the Session network. A separate Polygon contract supplies leak-blog posts and attachment references, while advertised stolen files are hosted on Wasabi. This architecture permits proxy rotation without replacing the victim-facing application and reduces reliance on conventional web infrastructure, although it remains dependent on accessible blockchain RPC gateways, a custom proxy, and removable cloud-hosted files. The Rust-based encryptor uses per-file XChaCha20 encryption with keys protected by Curve25519 and selectively encrypts files, including intermittent encryption of larger files. Before encryption, DeadLock deletes backups and Volume Shadow Copies and stops services. Its activity also includes AnyDesk-based remote control, log erasure, disabling logging, and self-deletion of scripts and the encryptor. Language- and country-based geofencing excludes former Soviet and CIS-linked environments and selected Middle Eastern countries. Ransom demands request Bitcoin or Monero payments in exchange for decryption and promises to delete stolen data.

PoisonSeed is a financially motivated cybercrime actor active since March 2025 that conducts phishing, account takeover, and cryptocurrency theft. It targets cryptocurrency users and platforms, bulk email and customer relationship management services, enterprise cloud services, and financial and technology organizations. Its targeting includes the United States, United Kingdom, Canada, and Australia. The group compromises email and marketing accounts, including SendGrid and Mailchimp accounts, to export contact lists and distribute follow-on phishing at scale through trusted infrastructure. Its React-based adversary-in-the-middle phishing kit impersonates legitimate authentication portals, relays credentials and multifactor authentication inputs, and captures authentication cookies for session hijacking. The kit validates encrypted victim identifiers before presenting login forms and uses fake Cloudflare Turnstile challenges, anti-bot delays, and conditional redirects to impede automated analysis. PoisonSeed also creates API keys to maintain access to compromised services. Cryptocurrency campaigns use fake wallet upgrades or migration notices to harvest recovery phrases or persuade victims to initialize wallets with attacker-provided recovery phrases, enabling subsequent theft of funds. The group rapidly rotates phishing infrastructure and impersonates established email, cloud, and cryptocurrency brands. Although its tactics and infrastructure overlap with Scattered Spider and CryptoChameleon, PoisonSeed is tracked as a distinct actor; no confirmed subgroup or alias relationship with those actors is established.

UAT-11985 is a threat actor tracked by Cisco Talos for a spear-phishing campaign observed in mid-2026 targeting individuals affiliated with research organizations in Taiwan. Its country of origin and state affiliation have not been established. The actor impersonates academic and policy institutions, including the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute. Its fraudulent event invitations combine authentic event information, fabricated sender identities, personalized praise, and deceptive registration links. It also copies legitimate event posters and replaces their QR codes with malicious registration codes. The campaign uses convincing Google Forms imitations to direct victims to spoofed Google authentication pages. An operator-driven adversary-in-the-middle framework relays account identifiers, passwords, and authentication challenges between victims and Google's legitimate authentication service. HTTP POST requests carry browser information, credentials, and challenge responses, while persistent WebSocket connections deliver authentication-state updates and operator instructions. This real-time relay enables authenticated-session token theft and account takeover after victims complete MFA, rather than defeating the verification mechanisms themselves. The phishing interface supports Simplified Chinese, Traditional Chinese, and English. Its JavaScript uses Base64-encoded strings, control-flow obfuscation, and runtime array rotation to hinder analysis.

NightSpire, also tracked as nightspire_ransomware, is a financially motivated cybercriminal group that emerged in early March 2025. Its operations encompass ransomware and data extortion, combining theft of sensitive information with encryption and threats of public disclosure. The group operates a dark-web leak site that lists victims, advertises stolen data, and displays publication countdowns. It also uses pressure emails and public shaming to encourage ransom negotiations. NightSpire targets organizations across North America, Europe, Asia, the Middle East, and South America. Its targets include healthcare and pharmaceutical organizations, manufacturers, technology companies, educational institutions, government and law-enforcement entities, retailers, hospitality businesses, transportation companies, and professional-services firms. Its extortion model exploits both the sensitivity of stolen information and victims’ dependence on operational availability. NightSpire’s intrusion techniques include exploitation of internet-facing FortiOS appliances through CVE-2024-55591, enabling authentication bypass and acquisition of super-administrator privileges. The group conducts external scanning and internal host, service, and file discovery, then uses remote services and file-transfer mechanisms for lateral movement. It abuses legitimate administrative utilities, including WinSCP, MEGACmd, and 7-Zip, to support collection and exfiltration while blending into routine activity. Stolen information is transferred to MEGA cloud storage over encrypted channels before encryption and extortion. No country of origin, state sponsorship, confirmed subgroup structure, or ransomware-as-a-service operating model has been established.

Redact is a financially motivated cybercriminal data-extortion brand formerly known as BlackFile and associated with the UNC6671 activity cluster. It shares phishing infrastructure and operational tradecraft with the Pink, Helix, and Falcon extortion brands. These brands are linked operationally, but their organizational boundaries are not established, and they should not be treated as interchangeable actor identities. Redact-associated campaigns target U.S. enterprises, particularly financial institutions, private equity firms, financial ratings agencies, and law firms. The broader associated activity also targets healthcare, manufacturing, technology, transportation, hospitality, and real estate organizations. Operators select businesses holding sensitive corporate information that can provide leverage for extortion, including investment, litigation, intellectual-property, and customer data. The intrusion model centers on telephone-based social engineering. Operators impersonate corporate IT help desks, sometimes spoof legitimate telephone numbers, and contact employees on personal mobile devices. Urgent passkey, MFA, or single sign-on migration pretexts direct victims to organization-branded phishing portals. Adversary-in-the-middle phishing captures credentials and authenticated sessions, enabling access to Microsoft 365, Okta, and connected SaaS applications. Associated UNC6671 operations establish persistence through attacker-controlled MFA registrations, enumerate cloud resources, and automate data collection from SharePoint, OneDrive, and other enterprise repositories. Compromised mailboxes are also used to reset passwords for applications outside single sign-on, while security notifications and reset confirmations are deleted to conceal activity. Stolen information is monetized through demands for payment to prevent public disclosure. Redact operates a darknet extortion presence; claims of ransomware encryption in individual incidents have not been independently established.

The Islamic Cyber Resistance in Iraq, also known as 313 Team, is an Iraq-associated, pro-Iran hacktivist group that claims distributed denial-of-service attacks against technology, e-commerce, and social-media organizations. Its claimed targets include UK-based Canonical, eBay operations in Japan and the United States, and Bluesky. The group uses Telegram to announce operations and communicate threats to targeted organizations. In April 2026, the group claimed responsibility for a sustained, cross-border DDoS attack against Canonical's Ubuntu infrastructure. The incident disrupted public websites and services, including Launchpad and the Snap Store, and impeded some users' downloads, account access, and software updates. Although the group initially announced a four-hour operation, disruption continued for more than 12 hours. It subsequently threatened continued attacks unless Canonical contacted it. Its responsibility for the incident was self-claimed; no connection was established between this campaign and the separate October 2026 attack against Canonical.

ALPHV, also known as BlackCat and Noberus, was a financially motivated ransomware-as-a-service operation that emerged in late 2021. Its operators developed Rust-based ransomware and supplied infrastructure to affiliates responsible for compromising organizations, stealing data, and deploying encryption payloads. The operation used double extortion, combining encryption with threats to publish stolen information on a data-leak site. Its ransomware supported Windows, Linux, and VMware ESXi environments. Operators recruited experienced intrusion specialists and initial access brokers through Russian-language cybercrime forums, advertising affiliate payouts of up to 90% of ransom proceeds. ALPHV intrusions involved compromised credentials, exploitation of exposed enterprise software, and compromise of Active Directory user and administrator accounts. Attackers used PowerShell, Cobalt Strike, Windows administrative utilities, and Sysinternals tools, including scheduled tasks and malicious Group Policy Objects for ransomware deployment. Affiliates performed reconnaissance to identify sensitive information and high-value systems, exfiltrated data before encryption, and disabled security controls. Participating intrusion groups included Scattered Spider and Pistachio Tempest, also known as FIN12. These affiliates were distinct actors rather than aliases for ALPHV’s core operators. The operation attacked enterprise organizations, including U.S. healthcare technology company Change Healthcare in February 2024. That intrusion used stolen credentials against a remote-access service without multifactor authentication and caused extensive disruption to healthcare payments and claims processing. The FBI linked ALPHV developers and money launderers to the earlier DarkSide and BlackMatter operations, without establishing that those groups were interchangeable identities. Law enforcement disrupted ALPHV infrastructure in December 2023, and the operation ceased activity by March 2024. Former affiliates subsequently moved to other ransomware programs.

Tren de Aragua (TdA) is a financially motivated transnational criminal organization that originated as a Venezuelan prison gang in the mid-2000s and expanded across the Western Hemisphere, including into the United States. Its criminal activities include drug trafficking, human trafficking, extortion, money laundering, and violent crime. The United States designated it as a Transnational Criminal Organization in July 2024 and a Foreign Terrorist Organization in February 2025; these designations do not establish state sponsorship. TdA is linked to a transnational ATM-jackpotting network based in Venezuela and Mexico that targets U.S. banks and credit unions. The operation uses crews to survey ATMs, gain physical access, install Ploutus malware, and collect cash. The malware commands ATM cash-dispensing modules to release currency without debiting customer accounts. Deployed variants incorporate anti-analysis protections and self-deletion functionality to obstruct forensic investigation and conceal compromise. Proceeds are laundered through cryptocurrency transactions and businesses and transferred among TdA members and associates across national borders. Participants in the jackpotting conspiracy have received federal prison sentences, and U.S. investigators have established direct and indirect connections between the network and TdA.

Your Mule Cashout (YMCO) was a financially motivated international cybercrime money-laundering organization active from September 2007 through 2014. Led in part by Oleg Korniev, a Ukrainian-Russian dual national, it provided money-mule recruitment, transfer infrastructure, and cash-out services to cybercriminals in exchange for a percentage of stolen funds. YMCO maintained more than 15,000 money mules across the United States and operated parallel schemes in Germany, Italy, the United Kingdom, and Australia. It laundered at least $10 million stolen by malware-using hackers from more than 750 U.S. bank accounts at over 35 financial institutions. YMCO impersonated legitimate staffing and payment-processing companies, recruiting unwitting participants through spam emails and fictitious employment websites. Employment tests, contracts, and purported company policies made the offers appear legitimate. Recruits supplied bank details, received stolen funds into personal accounts, and were instructed to withdraw and remit the money overseas through Western Union or MoneyGram. Cash-out contractors in Moldova, Ukraine, Russia, and Latvia retained a portion of the transfers and returned the remaining proceeds to YMCO. This human relay network separated the hackers from the stolen funds and complicated financial tracing. Korniev managed personnel and daily operations and helped develop the organization's operating procedures; he subsequently pleaded guilty to offenses connected to the operation.