Loading story…
Reporting highlighted Coinbase Cartel, a newer extortion actor that prioritizes data exfiltration without encryption (“data-theft-first” extortion). The group is described as emerging in 2025 and rapidly scaling victim claims, with healthcare, technology, and transportation comprising a large share of targets; coverage also notes a notable concentration of victims in UAE healthcare. Initial access is attributed primarily to social engineering and the use of initial access brokers and exposed/underground-sourced credentials, followed by use of administrative accounts and log tampering to reduce detection.
Separate threat research detailed the Rublevka Team, a Russian cybercrime operation running a highly automated “scam-as-a-service” platform used to drain cryptocurrency wallets, with reported thefts exceeding $10M since 2023. The operation is characterized as affiliate-driven and Telegram-bot-enabled, providing landing-page generators, cloaking, and payout automation; campaigns commonly impersonate brands (e.g., Phantom, Jito, Bitget) and pivoted from TON to Solana, with a major campaign reportedly generating most of the revenue. A third article provided broad, industry-level ransomware targeting statistics for 2025 (e.g., manufacturing as the most-targeted sector) and examples of past incidents, but it did not materially add to either the Coinbase Cartel extortion reporting or the Rublevka crypto-drainer activity.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
Insikt Group at Recorded Future reported that Rublevka Team had stolen more than $10 million in cryptocurrency since 2023. The report said the latest Solana-focused campaign generated about $8.2 million of that total.
Within its first months of operation, Coinbase Cartel claimed more than 60 victims across multiple sectors, with healthcare, technology, and transportation making up over half of the total and UAE healthcare notably affected.
Bitdefender also ranked Coinbase Cartel among the top 10 ransomware groups in December 2025, showing the group's continued prominence after its emergence.
Bitdefender assessed Coinbase Cartel as a top-10 ransomware group in September 2025, reflecting the group's rapid rise despite using extortion without encryption.
During its first month of activity, Coinbase Cartel claimed 14 victims, indicating a rapid early expansion of its extortion operations.
The Coinbase Cartel threat actor emerged in September 2025, using a data-theft-only extortion model rather than encrypting victim systems. The group relied on social engineering, exposed credentials, and initial access brokers to compromise organizations.
After initially targeting TON, Rublevka Team shifted its scam infrastructure to Solana, where its drainer tooling reportedly supported more than 90 wallet types and used fake airdrop or token-purchase lures.
In the earlier phase of its operation, Rublevka Team focused its wallet-draining fraud on The Open Network (TON) ecosystem before later shifting to other chains.
Recorded Future said the Russia-linked Rublevka Team has been stealing cryptocurrency since 2023 through a highly automated scam-as-a-service model using social engineering, malicious landing pages, and Telegram-based tooling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cyber insurance and threat reporting indicate **ransomware operators are increasingly leaning on data theft and extortion** as organizations improve backup and recovery. Coalition’s 2025 claims data (across 100,000+ policyholders) shows **business email compromise (BEC)** and **funds transfer fraud (FTF)** dominated claims volume, while **ransomware** represented a smaller share but featured **sharply higher initial demands** (average just over **$1.0M**, with some as high as **$16M**) even as average loss severity declined—consistent with improved restoration and response reducing the leverage of pure encryption-only attacks. In parallel, the broader ransomware ecosystem continues to **reorganize rather than shrink** despite sustained law-enforcement disruption of major RaaS brands (e.g., LockBit/Hive/ALPHV), with reporting citing high victim-post volumes across dozens of active operations. Halcyon reported a **tactical shift among pro-Iranian/pro-Palestinian-aligned operators** away from *Sicarii* toward **BQTLock (Baqiyat 313 Locker)**, including promotion of “free” RaaS access via Telegram and targeting focused on the UAE, US, and Israel. Separately, **ShinyHunters** claimed a major theft from AI merchant-data platform *Woflow* (alleging internal data, PII, and transaction/order details) but provided no sample for verification at the time of reporting, while a separate SC Media piece used the **SoundCloud** incident (reported exposure of data tied to ~**29.8M** accounts) to highlight incident-response and crisis-management considerations rather than new technical findings.
Jun 29, 2026
Reporting and research indicate **ransomware/data-extortion activity remained elevated through 2025 into early 2026**, with threat actors increasingly emphasizing **data theft, public pressure, and supply-chain leverage** rather than encryption alone. Cyble’s threat landscape findings cited by TechRepublic put 2025 at **6,604 recorded ransomware attacks** (up **52% YoY**), with **731 attacks in December** and **2,000+ claims in the last three months of 2025**; the same reporting also notes **supply-chain attacks nearly doubled**, increasing the potential blast radius when service providers are hit. A major example is *Conduent*, where the **January 2025 ransomware attack** is now assessed to have impacted **~25 million Americans** (up from an initial **10 million**), with reporting describing **~8TB of data** stolen including **Social Security numbers and medical data**, alongside days of operational disruption. Separately, Accenture-linked research reported that the **World Leaks** extortion operation added a custom Rust-based tool, **`RustyRocket`**, described as a stealthy **data-exfiltration and proxy** capability using obfuscated, multi-layer encrypted tunnels and a runtime “guardrail” requiring a pre-encrypted configuration—features intended to make detection and monitoring difficult. Broader ecosystem reporting also highlights how **data leak sites (DLSs)** and “naming-and-shaming” tactics have become central to double-extortion pressure, while a weekly incident roundup underscores continued real-world disruption from ransomware (e.g., impacts to public services) and ongoing regulatory consequences for inadequate security controls following breaches.
Jun 29, 2026
Blockchain and incident-response reporting indicates ransomware victims are paying less often even as attackers claim more victims. Chainalysis data cited by *BleepingComputer* puts the 2025 victim payment rate at **28%** (down from **62.8%** in 2024 and **78.9%** in 2022) while noting a roughly **50% year-over-year increase** in claimed attacks; on-chain ransomware payments for 2025 were estimated at **$820M** with the expectation the total could approach or exceed **$900M** as additional attributions are made. Despite lower overall payment participation, the **median ransom payment increased** sharply (reported as up **368%**, from **$12,738** in 2024 to **$59,556** in 2025), alongside greater ecosystem fragmentation (Chainalysis observed **85 active extortion groups**), with drivers including improved incident response, regulatory scrutiny, law-enforcement actions, and market dynamics. Separately, the UAE Cyber Security Council said it **thwarted** an attempted ransomware operation targeting national digital infrastructure and “vital sectors,” describing activity that included network intrusion attempts, ransomware deployment efforts, and systematic phishing, and alleging the use of **AI-enabled tooling** to increase sophistication. Broader incident tracking also highlights the continued real-world impact of ransomware and extortion: CSIS summarized multiple 2025 cases including **Medusa**’s claimed breach of **SimonMed Imaging** (reported ~**1.2M** patients affected; **$1M** demand to delete data) and a ransomware-enabled breach of UK defense contractor **Dodd Group** attributed to **Lynx** (reported ~**4TB** stolen and subsequent leaking), underscoring that even with declining payment rates, high-impact data theft and extortion remain persistent risks.
Jun 29, 2026