[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foWrJow74wNMnDfQNz06DtT_d5nzLtq10DqbRTK6YPcs":3,"$fIwzv0khbBLlVwufUa4BmpcYClCDG7BC1w6TJegji65w":124},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":121,"created_at":122,"updated_at":123,"published_at":26},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Ransomware Group Claims 190 Victims Across 17 Sectors","Data-theft-only extortion group active since September 2025 has hit Turner & Townsend, Hitachi High-Tech, Caterpillar, and 185 other targets.","CoinbaseCartel, a data-exfiltration ransomware group that debuted in September 2025, has accumulated 190 claimed victims across 17 industry verticals, with recent hits on Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN\u002FCenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.",[10,11,12,13,14],"ransomware","data-exfiltration","coinbasecartel","dark-web","extortion","# CoinbaseCartel Ransomware Group Claims 190 Victims Across 17 Sectors\n\n*Data-theft-only extortion group active since September 2025 has hit Turner & Townsend, Hitachi High-Tech, Caterpillar, and 185 other targets.*\n\n**Tags:** `ransomware` `data-exfiltration` `coinbasecartel` `dark-web` `extortion`\n\n> CoinbaseCartel, a data-exfiltration ransomware group that debuted in September 2025, has accumulated 190 claimed victims across 17 industry verticals, with recent hits on Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN\u002FCenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.\n\n---\n\n## CoinbaseCartel: 190 victims, no encryption, just data theft\n\nCoinbaseCartel is a data-theft-only extortion group that steals corporate data and threatens to publish it unless victims pay. The operation does not encrypt systems or disrupt operations; it exfiltrates files and lists victims on a Tor-based leak site. The group has been active since September 2025 and has claimed 190 victims across 12+ industries, including aerospace, healthcare, financial services, and government & defense.\n\nThe name carries no connection to the legitimate Coinbase crypto exchange. CoinbaseCartel is part of the Scattered Lapsus$ Hunters (SLSH) collective, which also includes ShinyHunters, Scattered Spider, and Lapsus$ affiliates. The group draws from the same ecosystem and shares infrastructure, including a domain and overlapping TTPs, with its affiliates.\n\n## How CoinbaseCartel operates: infostealer logs to DLS\n\nThe attack chain starts with infostealer malware logs. RedLine, Lumma, and Vidar steal credentials from victim endpoints, and CoinbaseCartel uses those compromised pairs to access corporate systems directly. No additional malware is dropped on the victim side; the operation performs pure data exfiltration rather than deploying a second-stage payload.\n\nThe leak site runs on Tor at `fjg4zi4opkxkvdz7mvwp7h6goe4tcby3hhkrz43pht4j3vakhy75znyd.onion`. Victims appear under one of three statuses: Active, Leaking, or Leaked. A dedicated partnerships intake page on the DLS handles fixed-fee and revenue-sharing deals, requiring partners to submit a proposal with evidence of an existing compromise.\n\n## Recent high-profile hits: 15 new victims in 30 days\n\nCoinbaseCartel has added 15 new victims in the last 30 days, with the most recent batch hitting the DLS on July 14, 2026. The latest wave includes Axiom Global, Demand.io, and Cambridge Mobile Telematics, all US-based, followed by Caterpillar and Colliers Real Estate on July 20, and PanasonicAero on July 15.\n\nThe July 28 batch brings Accesso, a UK software firm, alongside M.B. Kahn Construction, CEN\u002FCenelec, and MIM Fertility. CEN\u002FCenelec is a Belgian standards body, making it one of the more unusual targets in the group’s recent run. M.B. Kahn Construction and MIM Fertility round out the UK and US entries from that date.\n\nThe 15-victim stretch spans from June 12 through July 28, 2026. Demand.io and Cambridge Mobile Telematics both landed on June 12, with CMT appearing again on June 2 and 5 as separate listings. Axiom Global, Caterpillar, and Colliers follow in mid-July, with PanasonicAero on the 15th and Accesso closing the run on the 28th.\n\n## Who's been hit: 190 victims across 34 countries\n\nCoinbaseCartel has claimed 190 victims across 34 countries, up from 100 in April 2026. The US leads with 71 victims, followed by the UAE (12), Germany (11), and the UK and France (10 each). The remaining 152 victims are spread across the other 29 countries.\n\nTechnology dominates the sector breakdown with 56 to 63 victims, depending on the tracker. Business Services follows with 21 to 30, then Manufacturing at 17 to 25, and Consumer Services at 17. Healthcare rounds out the top five. The full roster spans 12 industries: Aerospace, Agriculture and Food Production, Business Services, Construction, Consumer Services, Engineering, Finance, Financial Services, Government & Defense, Healthcare, Manufacturing, and an \"Other\" bucket for the long tail.\n\n## The SLSH connection: ShinyHunters, Scattered Spider, Lapsus$ ties\n\nCoinbaseCartel is a splinter from the Scattered Lapsus$ Hunters (SLSH) collective, a loose affiliate ecosystem that also includes ShinyHunters and Scattered Spider. The group functions as a data-theft-led extortion variant, distinct from the full-encryption ransomware its parent groups typically deploy. No confirmed personnel or codebase link exists to any predecessor outfit, but the operational overlap is consistent with a fork rather than a copy.\n\nThe connection is supported by shared infrastructure, including a common domain, and overlapping TTPs across the three affiliates. Both ShinyHunters and Scattered Spider have been identified as CoinbaseCartel affiliates in the same campaign wave. The custom tooling matches UNC6040 and UNC6240 activity clusters tracked in the broader ShinyHunters campaign, which places the group in the same tooling lineage as the other SLSH members.\n\nThe extortion pattern is a two-stage repeat: victims pay an initial ransom for the data, then face a second payment to delete the exfiltrated copy from backups or another location the victim failed to secure. This is the same double-dip approach observed across the SLSH ecosystem, and it is what makes the group’s DLS status flow (Active → Leaking → Leaked) more aggressive than a standard single-extortion model.\n\n## Key points\n\n- CoinbaseCartel is a data-theft-only extortion group that exfiltrates data and publishes it on a Tor DLS without encrypting victim systems.\n- The group has 190 claimed victims across 17 sectors, with the US leading at 71, followed by UAE (12), Germany (11), UK (10), and France (10).\n- Recent victims include Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN\u002FCenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.\n- The group draws from the ShinyHunters, Scattered Spider, and Lapsus$ ecosystem (SLSH collective) and uses infostealer logs (RedLine, Lumma, Vidar) as its primary infection vector.\n- CoinbaseCartel has no connection to the legitimate Coinbase cryptocurrency exchange and has advertised a $2M+ budget for zero-day exploits.\n\n## Further reading & sources\n\n- [coinbasecartel - Ransomware Group | Ransomwhere.org](https:\u002F\u002Fransomwhere.org\u002Fgroups\u002Fcoinbasecartel)\n- [Ransomware.live: coinbasecartel](https:\u002F\u002Fransomware.live\u002Fgroup\u002Fcoinbasecartel)\n- [CoinbaseCartel](https:\u002F\u002Fwww.halcyon.ai\u002Fthreat-group\u002Fcoinbasecartel)\n- [Dark Web Profile: CoinbaseCartel](https:\u002F\u002Fsocradar.io\u002Fblog\u002Fdark-web-profile-coinbasecartel\u002F)\n- [Ransomware.live: coinbasecartel](https:\u002F\u002Fwww.ransomware.live\u002Fgroup\u002Fcoinbasecartel)\n- [Steam Customer Data Exposed in CEVA Logistics Cyberattack](https:\u002F\u002Fsocradar.io\u002Fblog\u002Fsteam-customer-data-ceva-logistics-cyberattack)\n- [PanasonicAero Ransomware Claim (2026) — What’s Alleged & Am I Affected?](https:\u002F\u002Frecentbreaches.com\u002Fbreach\u002Fpanasonicaero-coinbasecartel-2026-07)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f",{"iocs":18,"actors":22,"malware":43,"targets":52,"timeline":83,"industries":88,"technologies":112},[19],{"type":20,"value":21},"domain","fjg4zi4opkxkvdz7mvwp7h6goe4tcby3hhkrz43pht4j3vakhy75znyd.onion",[23,28,32,38],{"url":24,"name":25,"slug":12,"type":10,"origin":26,"motivation":27},"\u002Fthreat-groups\u002Fcoinbasecartel","Coinbase Cartel",null,"financial",{"url":29,"name":30,"slug":30,"type":10,"origin":31,"motivation":26},"\u002Fthreat-groups\u002Fshinyhunters","shinyhunters","Russia",{"url":33,"name":34,"slug":35,"type":36,"origin":37,"motivation":27},"\u002Fthreat-groups\u002Fscattered-spider","Scattered Spider","scattered-spider","cybercrime","United States and United Kingdom (native English-speaking members)",{"url":39,"name":40,"slug":41,"type":10,"origin":42,"motivation":27},"\u002Fthreat-groups\u002Flapsus","LAPSUS$","lapsus","United Kingdom and Brazil",[44,46,48,50],{"name":45},"Vidar",{"name":47},"RedLine",{"name":49},"Lumma",{"name":51},"Ransomware",[53,58,62,66,69,72,76,79],{"name":54,"sector":55,"status":56,"geography":57},"Hitachi High-Tech","Technology","confirmed","Japan",{"name":59,"sector":60,"status":61,"geography":26},"CEVA Logistics","logistics","claimed",{"name":63,"sector":64,"status":56,"geography":65},"MIM Fertility","Healthcare","US",{"name":67,"sector":68,"status":56,"geography":65},"Caterpillar","Manufacturing",{"name":70,"sector":71,"status":56,"geography":26},"Xs Cad","Other",{"name":73,"sector":74,"status":56,"geography":75},"Colliers Real Estate","Real Estate","United States",{"name":77,"sector":78,"status":56,"geography":57},"PanasonicAero","Aerospace",{"name":80,"sector":81,"status":61,"geography":82},"Accesso","Software","United Kingdom",[84],{"date":85,"event":86,"description":87},"2026-07-15","Listing","PanasonicAero listed by coinbasecartel on leak site",[89,92,96,99,102,105,109],{"url":90,"name":55,"slug":91},"\u002Findustries\u002Ftechnology","technology",{"url":93,"name":94,"slug":95},"\u002Findustries\u002Ftransportation","Transportation","transportation",{"url":97,"name":64,"slug":98},"\u002Findustries\u002Fhealthcare","healthcare",{"url":100,"name":68,"slug":101},"\u002Findustries\u002Fmanufacturing","manufacturing",{"url":103,"name":71,"slug":104},"\u002Findustries\u002Fother","other",{"url":106,"name":107,"slug":108},"\u002Findustries\u002Freal-estate-facilities","Real Estate & Facilities","real-estate-facilities",{"url":110,"name":78,"slug":111},"\u002Findustries\u002Faerospace","aerospace",[113,116,118],{"vendor":114,"product":115},"AWS","S3",{"vendor":117,"product":77},"Panasonic",{"vendor":119,"product":120},"Valve","Steam","ransomware_incident","2026-09-18T17:05:03.820479+00:00","2026-10-16T12:28:30.172293+00:00",{"articles":125},[126,138,150,161],{"slug":127,"title":128,"summary":129,"tags":130,"hero_image_url":136,"story_type":121,"created_at":137},"lockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay","LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay","LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.",[10,131,132,133,134,135],"PetitPotam","NTLM relay","ProxyShell","LockFile","CVE-2021-36942","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay.png?v=3ebd8c1c3f","2026-09-26T07:06:42.867972+00:00",{"slug":139,"title":140,"summary":141,"tags":142,"hero_image_url":148,"story_type":121,"created_at":149},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs","Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.",[143,144,145,146,147,10],"Silent Ransom Group","Troutman Pepper Locke","law firm","data leak","SSN","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","2026-09-21T17:04:06.647891+00:00",{"slug":151,"title":152,"summary":153,"tags":154,"hero_image_url":159,"story_type":121,"created_at":160},"dark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys","Dark Project ransomware group hits Brainhunter Companies LLC and Brainhunter Systems Ltd.","Dark Project, a ransomware group first seen in April 2026, has published Brainhunter Companies LLC and Brainhunter Systems Ltd. as its latest victims, bringing its total to 19 known targets with 9 active extortion links on ransomware.live.",[155,156,10,157,158],"Dark Project","Brainhunter","double extortion","ransomware.live","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys.png?v=d6c0e0a4ac","2026-09-21T07:02:16.98855+00:00",{"slug":162,"title":163,"summary":164,"tags":165,"hero_image_url":168,"story_type":121,"created_at":169},"inc-ransom-extorted-24-us-law-firms-58-paid-without-a-leak","INC Ransom Extorted 24 US Law Firms; 58% Paid Without a Leak","SOCRadar identified 24 individualized INC Ransom extortion pages for US law firms from a March 2026 campaign, cross-referenced them against INC's leak site, and found only 10 of 24 (42%) listed, implying 14 (58%) paid or are unlisted.",[166,145,14,167,65],"INC Ransom","leak site","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Finc-ransom-extorted-24-us-law-firms-58-paid-without-a-leak.png?v=7e1c94e2e7","2026-08-31T12:15:18.010257+00:00"]