Coinbase CartelThreat actor
Coinbase Cartel is a ransomware threat actor that emerged in September 2025, focusing on data exfiltration rather than encryption, and has claimed over 60 victims, primarily in the healthcare, technology, and transportation sectors. The group employs TTPs such as social engineering, credential harvesting, and collaboration with Initial Access Brokers to gain initial access.From MISP Galaxy
Last reported 2 months ago, by AhnLab ASEC2 reports
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
July 2026 Ransomware Trend Report“… Gentlemen, DragonForce, Nova, Gunra, Everest, krybit, LockBit (LockBit 5.0), Qilin, Chaos, ShinyHunters, Morpheus, INC Ransom, and Coinbase Cartel continued their activities, while new data-stealing and ransomware groups—including Gammax, SECTION9, ExfilSquad, Shiba, GLOBAL SECR…”
-
July 2026 Dark Web Threat Actor Trend Report“Evidence has emerged that Coinbase Cartel operates a partnership program targeting actors who provide stolen data and corporate access credentials.”
Thanks — we review every report.