TheHatmanThreat actor
TheHatman is a highly organized threat actor known for systematically listing and selling internal employee directories stolen from major corporations, including nine Fortune 500 enterprises across various sectors. The actor claims to have obtained the data through compromised credentials, though the initial entry point remains under investigation.From MISP Galaxy
Last reported 22 days ago, by Silent Push1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1110.004Credential Stuffing
“…ese apps, while not malware, can create exposure to internal resources and make a corporate IP address appear to be the source of credential stuffing, fraud, or other abusive activity.”
- T1219Remote Access Tools
“Google’s threat-intelligence team and the FBI said the group uses fake IT-support calls, phishing emails, legitimate remote-access tools, and, in some cases, people impersonating technicians to gain physical access.”
- T1684Social Engineering
“Its paid tiers advertise tools and personas for exploit research, reverse engineering, social engineering, and financial tracing.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Weekly Cybersecurity Roundup: How Stolen Credentials Continue to Fuel Fraud“A threat actor known as TheHatman is reportedly offering large employee-directory datasets linked to several multinational companies, including McDonald’s, TCS, Vodafone, HCL Technologies, Kyndryl, IHG, Gap, Hexaware, and Wyndham Hotels.”
Indicators in its reports
named in the reports above- ntuser[.]manin 1 report
Copy this indicator · defanged
Thanks — we review every report.