Trending Adversaries

n0n, also styled N0n, is a financially motivated cyber-extortion group that uses a dark web leak site to demand payment and threaten publication of allegedly stolen organizational data. Its publicly identified targets include organizations in the United States, Brazil, South Korea, the Netherlands, and Egypt, spanning maritime transport and logistics, information technology, financial services, healthcare, and other commercial sectors. In October 2026, n0n listed 38 shipping, port, and logistics organizations across 18 countries in a single batch, demanding multimillion-dollar payments and setting an October 19 publication deadline. Its named maritime targets included Ocean Network Express, Santos Brasil, and BNCT Busan New Container Terminal. The group’s extortion claims encompass operational databases, shipping records, corporate documents, financial records, infrastructure configurations, and access credentials. Its victim listings use publication deadlines and payment-status labels to pressure organizations. Although associated with ransomware incident listings, n0n’s established public-facing activity is data-leak extortion; deployment of encryption malware is not established. Its maritime compromise claims have not been independently verified. Its initial-access methods, malware tooling, organizational structure, and country of origin are not established.

Black Nevas, also known as blacknevas and black_nevas, is a ransomware and data-extortion group that publicly claims organizational victims through a dedicated leak site. Its geographic targeting includes the United States, Canada, Saudi Arabia, and South Korea. Its claimed victims span financial services, information technology, healthcare, manufacturing, logistics, retail, and hospitality. Named victims include Optimum First Mortgage, Portable Intelligence, Enteroptyx Ophthalmology Products, The Rutherford Group, Westbrook Greenhouse Systems, Speed Group, Zuni Shopping Center, and L’azurde. The group claims theft of sensitive business and personal information, including financial and human-resources records, customer databases, email correspondence, technical documentation, and production data. Individual breach claims and reported data volumes are not independently established. Its country of origin, organizational structure, initial-access methods, and specific ransomware tooling are not established.

Qilin is a Russia-associated, financially motivated ransomware and data-extortion group also known as Agenda, GOLD FEATHER, Water Galura, and Phantom Mantis. Its victims span numerous countries, with the United States and United Kingdom particularly prominent. Targeted organizations include healthcare providers, financial institutions, manufacturers, transportation companies, technology businesses, retailers, utilities, and educational institutions. Qilin conducts ransomware attacks and steals sensitive information, maintaining a public leak site where it posts evidence of compromises. Its operations expose personal, financial, insurance, and medical information. In the May 2025 breach of Covenant Health, attackers accessed patient data, and Qilin subsequently claimed responsibility and published purported evidence on its leak site. The breach affected 478,188 individuals following an expanded forensic review of approximately 1.35 million stolen files. Qilin's victim base demonstrates broad geographic and sectoral targeting rather than a narrowly focused campaign.

Helix is a financially motivated cybercriminal extortion operation focused on stealing corporate cloud data and demanding payment to prevent its disclosure. Microsoft tracks actors operating under the Helix banner as Storm-3032, a group that splintered from BlackFile. Helix shares an overlapping extortion ecosystem with Redact, Pink, and Falcon; these brands should not be treated as interchangeable aliases for a single proven actor. Its targeting includes United States organizations across financial services, manufacturing, healthcare, logistics, professional services, and real estate. Helix-associated intrusion activity uses phishing and telephone-based social engineering to compromise Microsoft 365 accounts. Operators impersonate internal IT help desks and invoke urgent passkey, multifactor authentication, or single sign-on updates. Adversary-in-the-middle phishing captures credentials and authenticated session tokens, while device-code phishing induces victims to authorize attacker-controlled clients. Post-compromise activity includes registering attacker-controlled authentication methods for persistence, enumerating cloud identities and resources through Microsoft Graph, and systematically collecting SharePoint Online, OneDrive for Business, and Exchange Online data. Operators pace collection over hours or days and rotate infrastructure to reduce detection. Helix operates a data-leak platform that applies pressure through release countdowns and staged publication of stolen material, including SharePoint libraries divided into progressively released tiers. Its established extortion model centers on data theft and threatened disclosure; encryption deployment is not established.

Cloak is a financially motivated ransomware operation that emerged in late 2022 and operates within the ransomware-as-a-service ecosystem. It targets organizations across multiple sectors, including healthcare, business services, industrial organizations, and public education. Documented targets include organizations in Germany and Baltimore City Public Schools in the United States. Cloak uses ransomware and data theft to extort victims and maintains a dedicated leak site where it posts victim organizations. Its ransomware uses Babuk source code, and the operation shares infrastructure with Good Day, also known as ARCrypter; this infrastructure overlap does not establish that the groups are identical. Cloak was linked to the February 2025 breach of Baltimore City Public Schools, which exposed sensitive information concerning approximately 31,000 individuals.

iah6477 is a threat actor associated with reported ransomware incidents involving predominantly United States-based organizations. Incidents attributed to the actor span August through October 2026 and affect manufacturing, professional services, food production, retail, financial services, and technology organizations. Named targets include Middleby, Sunshine Mills, Buckle, Veritiv, Swagelok, TRC Companies, ProAmpac, MAT Holdings, and Acima. Several attributed incidents involve reported data volumes ranging from hundreds of gibibytes to multiple tebibytes, but those figures do not establish whether data was encrypted, exfiltrated, or published. The actor's origin, organizational structure, initial-access methods, malware families, and specific extortion practices are not established. No distinct aliases or subgroups are established.

PREY-0059 is a social-engineering threat cluster tracked by Arctic Wolf that impersonates internal IT help-desk personnel through external Microsoft Teams accounts to steal credentials and deploy Java-based remote access trojans on Windows systems. Its operators use organization-branded Microsoft Entra tenants and display names matching real IT personnel, sometimes contacting more than 20 employees within an hour. Victim-specific Amazon S3 landing pages imitate ServiceNow self-service portals, collect credentials through purported health checks, and distribute malicious archives disguised as Windows updates. The infection chain places a command on the victim's clipboard and instructs them to execute it through the Windows Run dialog. This extracts nested archives and launches Java source code using a bundled, legitimately signed Eclipse Adoptium OpenJDK runtime from a user-writable location. Observed intrusions established command-and-control communication in under five minutes of the initial Teams message, and endpoint detection products did not typically block execution. The Java RAT provides WebSocket-based command and control, operator-directed TCP proxying, Windows command execution, and file management. Its infrastructure uses Amazon CloudFront, with Azure Front Door configured as a fallback. Post-execution activity includes rapid collection of operating-system information, environment variables, network configuration, and running processes. Operators have queried domain controllers over LDAP within six minutes of payload execution and subsequently scanned other systems for SMB and RPC services.

PolinRider is a North Korea-linked software supply-chain campaign associated with Lazarus-aligned Contagious Interview activity and publicly tracked since early 2026. It targets software developers and cryptocurrency-sector personnel through malicious developer tools, poisoned repositories, compromised maintainer accounts, and infected package releases. Its distribution spans npm, Go, Composer/Packagist, and browser extensions, with thousands of public repositories affected. Related activity is tracked under the campaign names ChainVeil and ViteVenom; PolinRider also overlaps with the TasksJacker cluster. Operators use fake recruitment assessments, malicious packages, and developer-tooling execution mechanisms to infect workstations. Obfuscated JavaScript is appended to legitimate project configuration files or concealed in fake font assets, while Visual Studio Code tasks can trigger execution when a project is opened. Some compromised packages execute malicious code when imported rather than through installation hooks, while retaining their expected functionality. Stolen developer credentials and publishing tokens enable further repository modifications and malicious releases. Git history rewriting, falsified timestamps, whitespace padding, and checks for automated build environments conceal the activity. A distinguishing feature is blockchain-based payload and command-and-control resolution. Loaders use transactions on TRON, Aptos, and BNB Smart Chain to locate and decrypt follow-on code; Ethereum-based variants use the NullReceiver technique to recover infrastructure from transaction recipient data. Payloads associated with the campaign include BeaverTail, DEV#POPPER RAT, OmniStealer, and InvisibleFerret. Their capabilities include remote command execution, file exfiltration, clipboard collection, keylogging, and theft of browser data, wallet-extension data, system credentials, and developer secrets. Repository-triggered execution mechanisms and detached background processes support continued access and reinfection.

GhostAction is a software supply-chain threat activity cluster targeting GitHub maintainers, open-source repositories, and development automation. Its operators compromise maintainer accounts and inject malicious GitHub Actions workflows that harvest repository secrets and transmit credentials to attacker-controlled infrastructure. A September 2025 campaign compromised 327 GitHub users across 817 repositories and stole 3,325 secrets. Affected projects included at least nine npm packages and 15 PyPI packages. Additional GhostAction activity involved a cluster of 94 compromised repositories containing a credential stealer concealed as a font resource. A second-stage payload automatically executed the stealer and installed a cron job for persistence. The activity combines abuse of trusted software-development infrastructure, credential theft, disguised payload delivery, and automated exfiltration. GhostAction is a campaign designation; the operators' identities and national affiliation are not established.

DragonForce, also tracked as Slippery Scorpius and referred to as the DragonForce ransomware cartel, is a financially motivated ransomware operation that emerged in 2023. It adopted a ransomware-as-a-service model and announced a cartel structure in March 2025, allowing affiliates to use its infrastructure under their own branding. Its services include ransomware customization, affiliate administration panels, negotiation and victim-management systems, stolen-data storage, and data-leak publishing. Affiliates are offered 80% of ransom proceeds. The operation's geographic origin is not established. DragonForce targets organizations internationally, including manufacturing, construction, technology, healthcare, retail, telecommunications, financial services, transportation, and public-sector entities. Its attacks combine data theft and encryption with threats to publish stolen information. It operates leak portals that publish victim information and provide access to stolen data. Its ransomware supports Windows, Linux, and VMware ESXi environments, and its payloads have used the leaked LockBit 3.0 builder and customized Conti-derived code. DragonForce and its affiliates obtain access through phishing, compromised credentials, brute-force attacks against exposed remote-access services, and exploitation of vulnerable applications. A documented campaign exploited SimpleHelp vulnerabilities CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728 to compromise a managed service provider and distribute malicious software through legitimate remote-management infrastructure to downstream customers. Associated activity included credential harvesting, network reconnaissance, lateral movement, data exfiltration, and ransomware deployment. The operation uses legitimate administration tools and living-off-the-land techniques alongside tools such as Cobalt Strike, Mimikatz, and SystemBC. Its techniques include scheduled-task persistence, security-tool interference, event-log clearing, timestomping, anti-analysis checks, and bring-your-own-vulnerable-driver mechanisms to disable endpoint defenses. DragonForce also aggressively recruits access operators and penetration testers through cybercriminal forums.

Emperador is a financially motivated cyberextortion group publicly identified as a ransomware operation, with reported activity dating to at least September 2026. Its reported targets span the United States, Latin America, and Europe and include industrial businesses, retailers, healthcare providers, technology companies, transportation firms, professional-services organizations, and government bodies. No country of origin, state affiliation, additional aliases, or subgroups have been established. The group's documented extortion messaging centers on claims of stolen employee, customer, financial, and internal business records. It threatens public disclosure unless victims negotiate or pay, using deadlines and threats of additional disclosures to increase pressure. In its claim against SitePro Rentals, Emperador demanded $150,000 payable in Monero and asserted possession of approximately 338,000 payroll records alongside sensitive employee information. It also threatened disclosures involving SEVENOAKS, Electrolux, and OnTrac. The reported compromises and stolen-data claims lack independent technical confirmation. Although commonly labeled a ransomware group, Emperador has no established ransomware family or confirmed encryption behavior in the available evidence. Its initial-access methods, exploitation techniques, persistence mechanisms, and internal network activity remain undetermined.

GrayBravo, formerly tracked as TAG-150, is a Russian-speaking cybercriminal threat actor active since at least March 2025. It develops and operates a malware-as-a-service ecosystem centered on CastleLoader, CastleBot, and CastleRAT. The group is characterized by rapid development cycles, adaptation following public exposure, and extensive, multi-tiered infrastructure. Its malware has been deployed against financial institutions, U.S. government agencies, information technology firms, and logistics companies. GrayBravo-associated operations use Cloudflare-themed ClickFix lures and fraudulent GitHub repositories impersonating legitimate applications to induce victims to execute malicious commands. CastleLoader delivers remote-access tools and information stealers, including SectopRAT, WarmCookie, NetSupport RAT, Lumma Stealer, Stealc, RedLine, and Rhadamanthys. Its delivery chains employ obfuscated scripts, legitimate runtimes, encrypted payloads, in-memory execution, environment checks, and persistence mechanisms. CastleRAT exists in Python and C variants and supports host reconnaissance, command execution, and additional payload deployment; the C variant also supports keylogging and screen capture. CastleRAT uses Steam Community profiles as dead-drop resolvers to conceal command-and-control infrastructure. Additional TAG-150-attributed intrusions have deployed DinDoor, DenoRAT, and NightshadeC2 for remote control, credential and browser-data theft, session-cookie collection, and exfiltration. Associated tooling supports browser-process injection to bypass Chromium App-Bound Encryption. GrayBravo supplies a shared criminal platform rather than exclusively conducting every intrusion involving its malware. Distinct customer activity clusters include TAG-160 and TAG-161. The Iranian state-sponsored actor MuddyWater has also used its CastleRAT platform against Israeli targets; this customer relationship does not establish Iranian state affiliation for GrayBravo.

ARMORY CASTLE, formerly tracked as UNC5221 and also known as WARP PANDA, is a China-linked cyberespionage actor active since at least October 2023. Assessed to support Chinese state intelligence collection, it targets government organizations, technology companies, software-as-a-service providers, legal services firms, and business-process outsourcers. Its operations emphasize compromising internet-facing edge appliances and remote-access infrastructure to establish long-term access and pivot into internal networks. The actor has exploited vulnerabilities in Citrix NetScaler and Ivanti Connect Secure, including zero-days, and has historically expanded selective exploitation into broad opportunistic attacks after public disclosure. In late August 2026, it exploited BeyondTrust Remote Support vulnerability CVE-2026-102764 to upload files and deploy SAWFLY, a lightweight PHP webshell supporting encrypted bidirectional communications. Subsequent activity included root-level privilege escalation through SUID permissions, startup and configuration-template modifications that preserved passwordless administrative access across reboots and configuration resets, and attempts to extract passwords, API keys, and endpoint credentials using native appliance utilities. ARMORY CASTLE abuses legitimate remote-support capabilities and compromised administrator accounts for lateral movement and collection. It elevates account permissions, initiates sessions to downstream endpoints, and uses native file-transfer functionality to exfiltrate internal documents, including software inventories useful for reconnaissance. Its BARECLAW custom SOCKS5-over-WebSocket tunneler provides additional access through compromised appliances, with reverse-proxy modifications concealing the tunnel behind legitimate web infrastructure. The actor deletes system, application, web-server, and credential-access logs to hinder detection and investigation.

UNC5820, also tracked as CL-STA-0954, is a threat activity cluster associated with a prolonged intrusion into a telecommunications managed service provider beginning in September 2024. Its national origin, sponsorship, and dominant motivation are not established. The cluster gained initial access by exploiting the FortiManager vulnerability CVE-2024-47575, known as FortiJump. It exfiltrated configurations, management databases, credentials, private keys, and other cryptographic trust material associated with more than 500 managed FortiGate firewalls serving the provider and its customers. This exposure did not establish that all associated firewalls or downstream customer networks were compromised. The attackers used recovered credentials to establish unauthorized VPN sessions into internal network-management segments, impersonated FortiManager to retrieve device information, and deployed unauthorized packet-capture configurations to intercept network traffic. During subsequent activity, UNC5820 exploited CVE-2025-61624 to move from restricted administrative functionality to underlying operating-system access and deploy PEERSTITCH. This C-based ARM64 implant injects code into legitimate FortiOS logging and VPN processes, establishing an in-memory communication bridge that allows specially marked VPN sessions to bypass normal security checks. PEERSTITCH leaves no persistent executable on disk, opens no listening ports, and initiates no outbound connections of its own, instead operating through legitimate process traffic. The cluster also abused Apache certificate-management functionality to establish a separate reverse-shell command channel. Defense-evasion techniques included terminating logging services, clearing crash logs, deleting unauthorized administrator accounts and automated-script objects, overwriting malicious configuration content, and removing deployment executables.

Gold Melody, also known as ToyMaker, Prophet Spider, and UNC961, is a financially motivated initial access broker active since at least 2017. The group compromises organizations and transfers access to other threat actors, including operators associated with Maze, Egregor, and Cactus ransomware. Its opportunistic victimology includes retail, health care, energy, financial services, high-technology enterprises, and critical infrastructure organizations across North America, Northern Europe, and Western Asia. The group primarily gains access by exploiting vulnerable internet-facing applications and servers. Its exploitation history includes Oracle WebLogic vulnerabilities CVE-2020-14882 and CVE-2020-14750, GitLab CVE-2021-22205, Atlassian Confluence CVE-2021-26084, and Apache Log4j CVE-2021-44228. It has also used SQL injection. Following compromise, Gold Melody conducts host, user, domain, and network reconnaissance, harvests credentials, and establishes persistent remote access using web shells, Windows services, custom backdoors, and tunneling tools. Its malware inventory includes GOTROJ, HOLEDOOR, DARKDOOR, and LAGTOY, the latter also tracked as HOLERUN. LAGTOY provides reverse-shell functionality, service-based persistence, and anti-debugging logic. Observed credential-harvesting activity includes capturing host memory and dumping Windows registry hives. The group has archived and exfiltrated memory dumps and created unauthorized local administrator accounts to retain access. Gold Melody's access-brokering activity is operationally distinct from subsequent ransomware deployment. In a documented critical infrastructure intrusion, ToyMaker established access and harvested credentials before Cactus entered the environment approximately three weeks later. Follow-on data theft, double extortion, and ransomware preparations were conducted by Cactus rather than ToyMaker.

BYOD is a cybercriminal ransomware-as-a-service and data-extortion operation publicly active by October 2026. It operates a data-leak site, publishes victim listings and stolen information, and pressures organizations to establish contact by threatening further disclosure. Its publicly named targets span telecommunications, financial services, retail and e-commerce, manufacturing, and professional services, including organizations in the United States, Singapore, and Malaysia. BYOD's most substantiated public incident involves Trump Mobile. The group published a dataset containing approximately 3,615 records, including names, contact details, home addresses, and order information. Independent checks with affected individuals confirmed the accuracy of some records, although not every person listed was a customer. The exposed information also included personal details belonging to the Trump Organization's chief information officer. BYOD uses threatened disclosure and publication of sensitive customer and business information as leverage. Its victim notices offer to remove listings after organizations initiate communication. Despite its characterization as a ransomware operation, its documented public activity centers on data theft and extortion; deployment of file-encrypting ransomware has not been established.

Mustang Panda is a China-linked, state-sponsored cyberespionage actor active since at least 2012. Also known as Bronze President and Earth Preta, it is additionally tracked under names including RedDelta, TA416, Stately Taurus, HoneyMyte, Red Lich, and Temp.Hex. Its operations target foreign governments, diplomatic missions, defense ministries, nongovernmental organizations, minority groups, academic institutions, foundations, and research organizations. Activity is worldwide, with a pronounced focus on Asia-Pacific and additional targeting in Europe. Its dominant objective is intelligence collection and information theft aligned with Chinese strategic interests. The group commonly gains access through spearphishing attachments and links to malicious archives hosted on legitimate cloud-storage services. Lures use recipients’ native languages and reference diplomatic meetings, regional politics, international summits, and other current events. Delivery chains employ malicious shortcuts, executables disguised as documents, and legitimate applications that sideload malicious DLLs. Scheduled tasks and registry autostart entries provide persistence. Mustang Panda frequently deploys PlugX and has also used PUBLOAD, TONEINS, TONESHELL, and MQsTTang. PUBLOAD stages additional shellcode, TONEINS installs TONESHELL, and TONESHELL provides remote command execution, file transfer, host discovery, and named-pipe-based lateral movement. MQsTTang supports arbitrary command execution and uses MQTT for command-and-control communications. Defensive evasion includes encrypted payloads, obfuscation, in-memory shellcode execution, exception-based control flow, and sandbox checks. Post-compromise activity includes system and process discovery, document collection, credential theft from the Active Directory database using volume shadow copies, and preparation of password-protected archives before exfiltration. Router-focused activity tracked as Camaro Dragon has deployed the Horse Shell firmware backdoor to maintain access and provide covert infrastructure.

APT29 is a Russian state-sponsored cyberespionage group linked to Russia’s Foreign Intelligence Service (SVR). Widely used aliases include Midnight Blizzard, Cozy Bear, NOBELIUM, The Dukes, CozyDuke, BlueBravo, and Cloaked Ursa. Its SolarWinds-related activity has also been tracked as UNC2452, Dark Halo, SolarStorm, and StellarParticle. The group targets government and diplomatic institutions, military and defense organizations, think tanks, technology providers, and critical energy infrastructure. Its dominant objective is intelligence collection through covert access to organizational networks and cloud services. APT29 obtains initial access through software supply-chain compromise, exploitation of public-facing applications and remote-access infrastructure, phishing, and compromised identities. It compromised victims through trojanized SolarWinds Orion updates and has exploited vulnerabilities in JetBrains TeamCity, Citrix, Pulse Secure, Fortinet, Zimbra, and WinRAR. It conducts widespread vulnerability scanning and uses compromised accounts to access SSH, VPNs, and other remote services. Post-compromise techniques include Active Directory and remote-system discovery with AdFind, attempts to retrieve Group Managed Service Account passwords, browser-credential theft, data collection and exfiltration, process injection, and persistence through registry startup entries and scheduled execution. The group uses encoded or encrypted payloads, legitimate utilities such as 7-Zip, and TCP- and HTTPS-based command-and-control communications. Associated tooling includes Raindrop and Cobalt Strike. Microsoft tracks Storm-2945 as an operational sub-cluster of Midnight Blizzard; its CaptiveCrunch activity uses compromised captive portals, device-code phishing, ClickFix delivery, ChocoShell PowerShell stagers, and the CornFlake Go backdoor.

RondoDox, also tracked as the RondoDox botnet, is a threat-activity cluster operating a Linux-focused botnet identified in 2025. Its operations compromise Internet-facing IoT devices, consumer routers, cameras, video recorders, network appliances, and web applications through automated exploitation. Compromised systems support distributed denial-of-service attacks, cryptocurrency mining, and further malware deployment. Targeted organizations include government agencies, financial services firms, and industrial manufacturers, with observed attacks affecting the United States, Australia, France, Germany, and Austria. RondoDox uses an opportunistic, broad-spectrum exploitation strategy against both longstanding vulnerabilities in unsupported devices and newly disclosed remote-code-execution flaws. Exploited vulnerabilities include React2Shell (CVE-2025-55182), XWiki CVE-2025-24893, HPE OneView CVE-2025-37164, ASUS router CVE-2018-5999, and ShellShock (CVE-2014-6271). Its campaigns combine scanning, web application exploitation, credential theft, and lateral movement toward IoT infrastructure. Its multistage delivery chains use shell scripts and fallback download utilities to install architecture-specific Linux payloads. Deployed components include cryptocurrency miners, botnet loaders, health-check tools, and Mirai-derived malware; RondoDox has also distributed the Morte IoT malware family. Installation routines disable security controls, clear shell history, remove competing infections, and terminate rival processes. Loader components establish persistence through scheduled tasks and repeatedly eliminate competing malware. The operation uses compromised residential systems as distribution infrastructure. Its operators' geographic origin and any state affiliation are not established.

UNC6508 is a People’s Republic of China-nexus cyberespionage threat cluster targeting academic, medical, and military research organizations in the United States and Canada. Its targets include clinical providers, academic medical centers, military health institutions, professional advocacy organizations, and health regulatory bodies. Known campaign activity extends from September 2023 through November 2025, with prolonged undetected access in victim environments. Its collection priorities align with Chinese strategic interests and encompass defense intelligence, Indo-Pacific military operations, artificial intelligence, uncrewed systems, offensive cyber programs, and medical research. No additional established aliases or confirmed subgroups are publicly identified. UNC6508 compromises internet-facing REDCap servers and probes legacy installations running alongside current versions. The precise initial compromise mechanism has not been established. Following compromise, it deploys web shells, conducts internal reconnaissance, and collects database and service-account credentials. Its custom modular PHP malware, INFINITERED, trojanizes legitimate REDCap components to harvest login usernames and passwords and provide persistent remote access. By intercepting the REDCap upgrade process and injecting malicious code into subsequent versions, INFINITERED survives application upgrades. Its backdoor receives encrypted commands through HTTP cookies and supports shell execution, arbitrary SQL queries, file transfers, system information collection, and retrieval or deletion of harvested credentials. The actor uses stolen credentials to move laterally and obtain administrative access, including domain administrator accounts. It then abuses Google Workspace domain-level content compliance rules to silently BCC selected email communications to an attacker-controlled account. These rules filter messages using keywords and professional contact details associated with intelligence priorities, enabling continued collection through legitimate administrative functionality. UNC6508 conceals its operations using compromised routers, residential proxies, and virtual private server infrastructure, including US-based traffic-obfuscation networks.

Carbanak, also known as Anunak, is a financially motivated cybercriminal group with origins in Russia and Ukraine, active since at least 2013. It conducts targeted intrusions against banks, financial-service providers, payment processors, and hospitality businesses. Its objectives include fraudulent financial transfers, ATM cash-outs, and theft of payment-card data from point-of-sale systems. Its targets have included organizations in Russia, Ukraine, the United States, Germany, the United Arab Emirates, and Armenia. The group compromises selected high-value victims and moves laterally toward systems that can be monetized, including core banking platforms, SWIFT environments, payment gateways, ATM management systems, and point-of-sale servers. It abuses legitimate banking employees' credentials to execute fraudulent transactions. Initial-access methods include spearphishing with weaponized Office documents, embedded script payloads, and exploitation of vulnerable applications. Documented operations have exploited CVE-2015-1770 and CVE-2017-5638, while deployed malware has exploited CVE-2015-2426 for privilege escalation. Carbanak combines custom malware with publicly available tools, including Mimikatz, PsExec, and modified Tiny Meterpreter. Its arsenal includes the Carbanak backdoor, Agent.ORM, Wemosis point-of-sale memory-scraping malware, and the Go-based GOTROJ backdoor. Its implants support host reconnaissance, process enumeration, screenshot capture, remote control, and additional payload execution. Persistence includes Windows services, sometimes running with SYSTEM privileges. Defense-evasion techniques include process injection, digitally signed malware, masquerading as Windows components, and abusing Google Apps Script, Google Sheets, and Google Forms for command-and-control traffic. Carbanak should not be conflated with FIN7 merely because both groups have used the Carbanak malware family.

Wallstreet is a threat group associated with reported ransomware attacks against organizations in the United States, Sweden, the United Kingdom, Denmark, and Saudi Arabia. Its reported activity includes attacks recorded during September and October 2026. Its geographic origin, organizational structure, and relationships with other threat groups are not established. Reported targets span healthcare, manufacturing, architecture and professional services, electronics, packaging, real estate, and nonprofit organizations. Named victims include Green Clinic, Gibson Area Hospital & Health Services, St. Francis Healthcare Systems of Hawaii, Girl Scouts of Eastern Massachusetts, E-Z Pack Trucks, Tronex A/S, and Beatus Cartons. Swedish targets include elder-care provider Danvikshem, several architecture practices, and property company Vendus Sweden AB. Wallstreet's initial-access methods, ransomware family, persistence mechanisms, and lateral-movement techniques are not established. Specific use of encryption, data theft, leak-based extortion, or a ransomware-as-a-service operating model has not been independently established.

NightSpire, also tracked as nightspire_ransomware, is a financially motivated ransomware and data-extortion group that emerged in March 2025. It conducts international operations against healthcare, manufacturing, technology, education, government, professional services, retail, hospitality, construction, and transportation organizations. Its targets span North America, Europe, Asia, the Middle East, and South America. NightSpire uses double extortion, stealing sensitive information before encrypting systems and threatening public disclosure to compel payment. It also conducted data-theft extortion before adopting ransomware encryption. The group maintains a dark-web leak site featuring victim listings and publication countdowns, and applies pressure through direct messages and public shaming. Its operational model has not been established as either a centralized organization or a ransomware-as-a-service program. Its intrusion techniques include exploiting exposed FortiOS appliances through CVE-2024-55591, obtaining elevated administrative access, discovering internal hosts and services, and moving laterally through remote services and file-transfer mechanisms. NightSpire uses legitimate utilities including WinSCP, MEGACmd, 7-Zip, and Everything for file discovery, staging, and data transfer, blending malicious operations with routine administrative activity. Stolen information is exfiltrated to cloud storage, including MEGA, before encryption and ransom demands. The group also uses compromised credentials to expand access.