Loading threat actor…
ZeroBytes is a cybercriminal threat actor associated with data theft and attempted monetization of stolen information through cybercrime forums. The actor is linked to intrusions targeting France’s Directorate General of Public Finances (DGFiP), where it claimed responsibility for unauthorized access to internal systems and the exfiltration of taxpayer and cadastral data. Reporting and official statements corroborate that DGFiP suffered unauthorized access and data extraction affecting hundreds of thousands of individuals and professionals, while some broader claims made by ZeroBytes about scale and persistence of access remain unverified. ZeroBytes has been associated with the use of stolen credentials, abuse of legitimate remote access, and multi-factor authentication bypass to obtain access to sensitive government systems. The actor’s activity indicates post-compromise use of internal tools to search, consult, and extract records, followed by advertising stolen datasets for sale. Claimed and confirmed victim data included tax-related and cadastral information, creating downstream risks of identity theft, targeted phishing, business fraud, and other financially motivated abuse. The actor’s observed behavior is consistent with financially motivated cybercrime rather than espionage or disruptive operations. Known activity centers on exfiltration and sale of sensitive administrative data, with no high-confidence evidence in the available material of ransomware deployment, destructive actions, or public extortion beyond sale of stolen data. ZeroBytes is currently known primarily by the single alias ZeroBytes.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Claimed responsibility for breaching France’s tax authority systems, exfiltrating taxpayer and business data, and offering the stolen database for sale on a cybercrime forum.
Cybercriminal group claiming responsibility for exfiltrating DGFiP data, selling the stolen files to buyers, and continuing to offer the data for sale on dark web forums.
Claimed responsibility for the breach of France’s tax authority (DGFiP), allegedly accessing an internal tool via VPN with stolen professional credentials and exfiltrating taxpayer data that was later reportedly offered for sale.
Claimed responsibility for breaching French tax authority systems, stealing and attempting to sell taxpayer and cadastral data, and claiming continued access to the SPDC platform.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.