Loading threat actor…
Rumba is a Sweden-based criminal gang that has been reported as a proxy or intermediary used in Iranian-linked hybrid operations targeting Israeli or Jewish interests in Europe. Public reporting places the group in the category of criminal actors allegedly leveraged by Tehran for deniable violence rather than as an independent ideologically driven threat actor. In this role, Rumba has been cited alongside other criminal groups used to carry out attacks through locally available operatives, fitting a broader pattern of outsourcing hostile activity to disposable agents and criminal networks. Available information directly supports only a limited attribution profile. Rumba is associated with criminal facilitation of attacks on Israeli or Jewish targets in Sweden on behalf of Iranian interests. The reporting does not provide a detailed independent operational history, malware capability set, or broader victimology beyond this proxy role. There is no high-confidence evidence in the supplied facts to characterize Rumba as a ransomware actor or to ascribe a fuller cyber intrusion lifecycle. The dominant assessed motivation, insofar as it is acting as an Iranian proxy, is aligned with espionage and state-directed coercive activity rather than conventional profit-driven cybercrime.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.