Loading threat actor…
FulcrumSec is a financially motivated data-theft and extortion group active since at least late 2025. The group focuses on cloud-native and cloud-hosted environments, prioritizing theft of sensitive data for leverage rather than relying primarily on disruptive encryption. Reporting consistently associates FulcrumSec with rapid exfiltration from cloud databases and storage, abuse of exposed or unrotated credentials, exploitation of misconfigured cloud permissions, and compromise of internet-facing applications. The actor has been linked to intrusions affecting organizations in technology, financial services, healthcare, and education, including LexisNexis, Novo Nordisk, Global Schools Foundation, and the Australian fintech youX. FulcrumSec’s tradecraft centers on initial access through exposed secrets, weak identity hygiene, public-facing cloud misconfigurations, and exploitation of known vulnerabilities such as CVE-2025-55182, also referred to as React2Shell. Once inside, the group is reported to harvest additional credentials, abuse over-permissioned machine or cloud identities, move laterally across cloud services and development platforms, and conduct large-scale data exfiltration. Multiple accounts describe the actor operating across AWS, Azure, GitHub, Azure DevOps, Hugging Face, MongoDB, Databricks, and other SaaS or cloud resources. FulcrumSec has also been described as using legitimate transfer tooling for exfiltration and as favoring stealthy cloud and identity abuse over malware-heavy intrusion chains. The group is best characterized as an extortion actor rather than a classic ransomware operator. Its operations repeatedly involve theft of large volumes of corporate, personal, research, or operational data followed by ransom demands and public leaking when negotiations fail. FulcrumSec has been associated with leak-site operations and public shaming of victims, and has been identified in reporting as part of the broader rise of data-only extortion without encryption. In incidents involving Novo Nordisk and Global Schools Foundation, the actor allegedly stole substantial datasets and threatened or carried out publication of the data after unsuccessful negotiations. FulcrumSec has also been noted for using large language models to improve extortion operations. Reported uses include analyzing complex exfiltrated databases, identifying high-value relationships within stolen data, and generating technically precise or persuasive negotiation messages in English. This suggests an operational model in which AI is used as a force multiplier for post-compromise analysis and victim pressure rather than as the primary intrusion mechanism. Known aliases are limited, though the nickname “The Threat Thespians” has been associated with the group in some reporting. No high-confidence state affiliation is established. The dominant assessed motivation is financial gain through data theft and extortion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a previously observed threat actor that targeted LexisNexis in March 2026 by exploiting the 'React2Shell' flaw in AWS infrastructure, leading to theft and leakage of private files.
Claimed responsibility for attacking Novo Nordisk and releasing additional stolen data, including the company's enterprise HuggingFace AI/ML ecosystem, models, datasets, and proprietary microscopy images.
Named as the threat actor behind a prior intrusion targeting LexisNexis, exploiting the React2Shell flaw in AWS infrastructure to steal and leak private files.
Extortion-focused group using AI agents to process stolen data and support extortion operations.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.