Loading threat actor…
CoinbaseCartel is a financially motivated cybercriminal extortion group known for ransomware-associated intrusions and, in particular, data-theft-only extortion operations that rely on stealing corporate information and threatening publication rather than consistently encrypting victim systems. By April 2026, the group had claimed more than 160 victims. Reported victimology indicates broad opportunistic targeting across multiple regions, including North America, Europe, East Asia, and South Korea, with affected organizations spanning technology, manufacturing, healthcare, financial services, construction, agriculture and food production, real estate, professional services, and standards bodies. The group has been associated with attacks against organizations in the United States, United Kingdom, Belgium, France, Japan, Israel, and South Korea. Reported cases include compromises of healthcare and medical-device-related entities, including a South Korean ultrasound medical-device company, indicating a willingness to target organizations holding sensitive operational and personal data for extortion leverage. The actor has also been linked to incidents affecting logistics and enterprise service providers, including a previously claimed breach of CEVA Logistics in 2025 involving alleged exfiltration of business and financial data. Operationally, CoinbaseCartel is associated with exfiltration-centric extortion and ransomware-branded victim postings. Available reporting indicates that stolen credentials from infostealer logs likely supported much of the group’s activity, supporting an assessment that credential theft and follow-on unauthorized access are important parts of its intrusion model. High-confidence reporting specifically describes the group using data theft without file encryption in at least some operations. Publicly available information in this dataset does not establish a confirmed nation-state affiliation.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a ransomware attack against Sweet Water Holdings.
Conducting a ransomware attack against Serruya Private Equity.
Conducting a ransomware attack against Turner and Townsend.
Named as a primary threat to South American government and law enforcement entities.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.