Loading threat actor…
Space Bears is a ransomware and data-extortion operation that emerged in April 2024 and is associated with the Phobos ransomware-as-a-service ecosystem. The group operates a dedicated leak site and has repeatedly claimed intrusions against organizations in multiple regions, including Europe, the Americas, Asia, and Australia. Reported victims span retail, information technology, telecommunications, managed services, health care, industrial and logistics-related businesses, and other commercial enterprises. Space Bears follows a leak-site-driven extortion model centered on data theft and public exposure of stolen information. Victim postings commonly claim exfiltration of databases, financial records, employee and customer information, and other internal business documents, and the group has threatened staged publication when payment is not made. Reporting also indicates that the operation has published stolen data and, in some cases, offered valuable data to third parties, indicating a mature extortion workflow rather than encryption-only ransomware. Infrastructure reporting has linked Space Bears-related systems to hosting environments and bulletproof-hosting ecosystems also associated with other criminal operations, including ShadowSyndicate-linked infrastructure. One reported overlap tied Space Bears infrastructure to Layer7 Networks, and broader reporting connected related infrastructure patterns with malware and ransomware activity involving BlackCat/ALPHV affiliates, Clop, and SystemBC. These overlaps suggest Space Bears operates within a broader cybercriminal service ecosystem rather than as an isolated actor. Known aliases include spacebears and space_bears. High-confidence reporting supports characterization of Space Bears as a financially motivated cybercriminal ransomware actor using leak-site extortion, data exfiltration, and post-compromise coercion against a geographically diverse victim set.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a ransomware attack against SEARS (Grupo Sanborns), with demo files expected ahead of a full-scale release.
Conducting a ransomware attack resulting in a data breach against Basso Fedele & Figli S.r.l. (Olio Basso) / Villa Raiano.
Conducting a ransomware attack resulting in a data breach against Elixi International SA, with stolen SQL data, personal information of employees and clients, and financial documents.
Conducting a ransomware attack against Hitech Distribuzione Informatica S.r.l. (HTDI), an Italian technology company.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.