Profiles of criminal groups, nation-state operators and emerging clusters: motivations, targeting, tradecraft and ATT&CK mappings.
62 reports
LAPSUS$ is an extortion-focused cybercriminal collective best known for high-tempo intrusions against large enterprises and service providers, frequently leveraging social engineering and identity…
Cl0p (often written “CL0P”) is a financially motivated extortion operation best known for high-scale data theft campaigns that disproportionately impact organisations running internet-facing…
A widespread data-theft and extortion campaign has targeted organisations’ Salesforce environments by abusing trusted third-party integrations and malicious OAuth “Connected Apps” —rather than…
A cluster of ransomware intrusions attributed to Akira affiliates surged in late July 2025 , with defenders reporting initial access via SonicWall Gen 7 (and newer) firewalls where SSLVPN was…
In a significant development, the UK's National Crime Agency (NCA) has named Aleksandr Ryzhenkov as a key figure in the notorious Russian cybercrime group Evil Corp, while also identifying him as…
In September 2024, JPCERT/CC released a detailed blog post uncovering how Windows Event Logs can be a powerful tool for identifying human-operated ransomware campaigns. The research focuses on…
In September 2024, U.S. authorities raised alarms over a significant threat that has been quietly gaining momentum this year— RansomHub , a ransomware-as-a-service (RaaS) platform that has been…
In May 2024, cybersecurity researchers uncovered a sophisticated attack campaign known as "Dev Popper," where hackers posed as recruiters conducting fake job interviews to distribute a…
Mandiant has highlighted Russia and Iran as prominent state-sponsored cyber threats poised to disrupt the 2024 elections. Their tactics, often multilayered and complex, include data theft, DDoS…
A new phishing campaign leveraging Autodesk Drive has come to light, targeting corporate users through seemingly legitimate PDF files. Cybersecurity experts at Netcraft have uncovered that…
INC Ransomware is an opportunistic cybercriminal group active since mid-2023. Known for its rapid proliferation and impact across various industries, INC Ransomware has demonstrated a potent…
Hunters International is a newly identified ransomware group that has recently come to prominence. This group is particularly notable for its use of code with similarities to the now-defunct Hive…
