FulcrumSecThreat actor
FulcrumSec is a financially motivated data-theft-extortion group known for sophisticated ransomware attacks and double extortion tactics. They have exploited vulnerabilities such as hardcoded credentials and misconfigured cloud permissions to gain access to targets, including Novo Nordisk and Arup Group.From MISP Galaxy
Last reported yesterday, by Risky Business News3 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1059.009Cloud API
“Stolen Cloud API Key to Blame for Imperva Breach”
- T1195Supply Chain Compromise
“Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application.”
- T1542.003Bootkit
“APT41 revives BlackLotus bootkit: Chinese cyber espionage group APT42 has been using new versions of the BlackLotus bootkit , named BlackX, which they have used to target entities all over Central Asia.”
- T1552.004Private Keys
“Browser makers untrusted its root after it used weak private keys to generate eight intermediary certificates.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“TiDB Cloud hacked by FulcrumSec: The FulcrumSec hacking group has breached the TiDB Cloud service.”
-
August 2026 Threat Trend Report on Ransomware“In August 2026, major groups such as The Gentlemen, Qilin, CL0P (Clop), Gunra, CRPx0, DragonForce, Orova, FulcrumSec, Emperador, and Helix continued their activities.”
-
FulcrumSec Claims Responsibility for Manchester Airport Group Breach“FulcrumSec Claims Responsibility for Manchester Airport Group Breach”
Indicators in its reports
named in the reports above- railway[.]comin 1 report
- pylos[.]coin 1 report
- infosec[.]exchangein 1 report
- masto.deoan[.]orgin 1 report
- sheogorath.bsky[.]socialin 1 report
- chaos[.]socialin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.