Loading threat actor…
Zestix, also known as Sentap, is a financially motivated cybercriminal threat actor operating as an initial access broker and data seller. The actor has been linked to a campaign active from at least late 2024 through early 2026 in which credentials harvested by infostealer malware were used to access enterprise cloud file-sharing and collaboration environments, particularly ShareFile, Nextcloud, and ownCloud deployments. Reporting consistently describes the actor using credentials obtained from RedLine, Lumma, and Vidar infections on employee devices, then logging in with valid accounts rather than exploiting software vulnerabilities. Zestix has been associated with breaches affecting roughly 50 organizations across multiple sectors, including defense-related engineering, healthcare, legal services, finance, aviation, utilities, construction, robotics, and government-linked infrastructure. Stolen data reportedly included engineering blueprints, healthcare records, legal archives, financial documents, and other sensitive corporate repositories. The actor has been observed auctioning exfiltrated data and selling access on underground, including Russian-language, cybercrime forums. The actor’s tradecraft centers on credential-enabled intrusion: harvesting or acquiring infostealer logs, identifying enterprise accounts tied to cloud collaboration platforms, authenticating with valid credentials, and exfiltrating data from information repositories. Multiple accounts indicate that absent multi-factor authentication and poor credential hygiene were key enablers, with some reused credentials reportedly remaining valid for years. Zestix is therefore notable less for exploit development than for effective operationalization of commodity infostealer ecosystems and stealthy abuse of legitimate access. Attribution in available reporting indicates the actor is believed to be an Iranian national. Some reporting also notes possible links to the FunkSec criminal ecosystem, but those links are not sufficiently corroborated to characterize as definitive. Zestix/Sentap is best understood as an opportunistic, access-focused cybercriminal actor whose operations demonstrate how infostealer-derived credentials can be converted into enterprise compromise, large-scale data theft, and resale of stolen access or data.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducted credential-based intrusions into cloud file-sharing platforms using credentials harvested by infostealers, leading to theft of defense, healthcare, legal, and financial data without exploiting software flaws.
Initial access broker of Iranian origin, selling access to compromised corporate file-sharing portals, motivated by financial gain and linked to ransomware group FunkSec.
Zestix is known for stealing and selling corporate data obtained by breaching file-sharing platforms such as ShareFile, Nextcloud, and ownCloud, using credentials harvested by infostealer malware.
Zestix is a lone hacker, believed to be an Iranian national, who used infostealer malware to obtain credentials and access sensitive data from approximately 50 major companies worldwide. The stolen data is being auctioned on dark web forums.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.