Loading threat actor…
Genesis is a cybercriminal operation associated with two distinct but related forms of activity in the available reporting: a credential-and-browser-fingerprint marketplace and a ransomware actor name used in victim claims during 2026. The marketplace, launched in 2018, specialized in selling stolen digital identities assembled from credentials, browser cookies, and device or browser fingerprinting data collected from compromised users. It offered tooling to import purchased identities into a browser environment, enabling buyers to impersonate victims and evade anti-fraud controls. This activity supported online fraud, account takeover, identity theft, and related criminal operations, particularly through abuse of session data and victim browser profiles. Separately, Genesis is also cited as the threat actor behind multiple ransomware and data-breach claims in 2026. Reported victims span healthcare, information technology services, construction and industrial firms, financial services, and real estate, with a strong concentration in the United States and at least one reported victim in Denmark. In these incidents, Genesis is associated with ransomware intrusions accompanied by data theft or breach claims rather than only credential abuse. Across the combined reporting, Genesis demonstrates capabilities in credential theft, session hijacking through stolen cookies and browser-state data, defense evasion via victim fingerprint cloning, initial access and post-compromise abuse of stolen identities, and exfiltration in ransomware-linked incidents. The dominant motivation is financial gain.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
15 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a ransomware attack against a healthcare organization (Interim HealthCare).
Conducting a ransomware attack against a healthcare organization in the United States.
Conducting a ransomware attack against a healthcare organization in the United States.
Named in the weekly raw data as a ransomware group with 9 claimed attacks.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.