Loading threat actor…
TheHatman is a cybercriminal threat actor observed advertising alleged stolen internal employee directory data from multiple large enterprises. The actor has claimed access to Microsoft Azure and Microsoft Entra tenant data using compromised credentials and has offered datasets associated with major multinational organizations in sectors including retail, telecommunications, information technology services, hospitality, and consulting. Reported victim organizations include McDonald’s, Tata Consultancy Services, Vodafone, HCL Technologies, InterContinental Hotels Group, Kyndryl, Gap, Hexaware Technologies, and Wyndham Hotels. The advertised datasets reportedly contain enterprise identity and directory information such as employee names, corporate contact details, employee identifiers, job titles, departments, reporting structures, group memberships, service account information, and in some cases privileged administrator account listings. This type of data would support follow-on operations including spear-phishing, business email compromise, account targeting, and privilege escalation. The actor’s claimed intrusion method centers on abuse of valid cloud credentials rather than exploitation of a platform vulnerability. Reported possible access paths include credentials or session material stolen by infostealer malware, phishing-derived account compromise, weak or absent multifactor authentication enforcement, and abuse of overprivileged third-party integrations. High-confidence reporting links the campaign to the sale of allegedly exfiltrated cloud directory data, but the precise initial access mechanism remains unconfirmed. The available evidence supports characterization of TheHatman as a financially motivated data broker or intrusion actor focused on credential-enabled access and exfiltration from enterprise cloud identity environments.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
15 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Selling alleged employee database dumps from multiple companies, claiming the data was downloaded directly from Azure/Entra tenants using compromised credentials.
Allegedly stole and offered for sale millions of employee records from multiple corporate Microsoft Azure/Entra tenants, reportedly using compromised credentials. The article also notes claims of password spraying and MFA fatigue, while researchers assess infostealer-derived credential theft as a likely access path.
Selling allegedly stolen Azure/Entra tenant data exfiltrated from multiple Fortune 500 and large enterprise organizations, reportedly using leaked credentials likely obtained via a targeted infostealer campaign.
Conducting an Azure/Entra credential-theft-driven data exfiltration and monetization campaign, allegedly stealing internal employee directory data from large enterprises and selling the records on underground forums.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.