[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foWrJow74wNMnDfQNz06DtT_d5nzLtq10DqbRTK6YPcs":3,"$fIwzv0khbBLlVwufUa4BmpcYClCDG7BC1w6TJegji65w":62},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":59,"created_at":60,"updated_at":61,"published_at":22},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Extortion Group Has Listed More Than 200 Claimed Victims","The data-theft-only group has posted 207 claimed victims since September 2025, according to ransomware.live, though researchers warn the raw count includes unverified and disputed claims.","CoinbaseCartel, a data-theft extortion group that appeared in September 2025, has 207 claimed victims on ransomware.live, 76 of them in the US; researchers link its access mainly to reused infostealer credentials, while a suggested tie to the Scattered LAPSUS$ Hunters ecosystem remains unconfirmed.",[10,11,12,13,14],"ransomware","data-exfiltration","coinbasecartel","dark-web","extortion","# CoinbaseCartel Extortion Group Has Listed More Than 200 Claimed Victims\n\n*The data-theft-only group has posted 207 claimed victims since September 2025, according to ransomware.live, though researchers warn the raw count includes unverified and disputed claims.*\n\n**Tags:** `ransomware` `data-exfiltration` `coinbasecartel` `dark-web` `extortion`\n\n> CoinbaseCartel, a data-theft extortion group that appeared in September 2025, has 207 claimed victims on ransomware.live, 76 of them in the US; researchers link its access mainly to reused infostealer credentials, while a suggested tie to the Scattered LAPSUS$ Hunters ecosystem remains unconfirmed.\n\n---\n\n## A data-theft-only extortion group\n\nCoinbaseCartel is an extortion group that steals data and threatens to publish it, rather than encrypting systems. It describes its operations as never involving system encryption or operational disruption. SOCRadar first identified its Tor leak site on 15 to 16 September 2025, when the group posted its first batch of claimed victims at once.\n\nAccording to SOCRadar and Halcyon, victims are given 48 hours to make contact and then 10 days to pay or renegotiate, with ransoms accepted only in Bitcoin. Leak site entries move through three statuses: Active, Leaking and Leaked. An auctions section added in early 2026 lets third parties bid on stolen datasets, and a partnerships section offers fixed-fee and revenue-sharing deals to people who can show evidence of an existing compromise.\n\n## How it gets in\n\nResearchers at SOCRadar identify stale infostealer logs as the dominant initial access vector, with credentials harvested by families such as RedLine, Lumma and Vidar reused against corporate cloud environments, FTP and SFTP servers and managed file transfer services. Halcyon also lists vishing, OAuth application abuse, exposed credentials in cloud repositories and attempts to recruit insiders. No CVEs have been attributed to the group. In late 2025 the group advertised a budget of more than $2 million for zero-day exploits.\n\n## The numbers, and their limits\n\nAs of 19 October 2026, ransomware.live lists 207 claimed CoinbaseCartel victims, with the most recent posting on 23 August 2026. By country, the United States accounts for 76, followed by Germany and the United Arab Emirates with 12 each, France with 11 and the United Kingdom with 10. By sector, ransomware.live counts technology at 63, professional services at 30, manufacturing at 25, and retail and e-commerce and financial services at 18 each.\n\nThese are the group's own claims. Halcyon notes that unverified claims, denials and re-uploads inflate the raw numbers, and that at least two claims were taken down after the named organisations denied being breached. It also reports that new listings slowed after April 2026.\n\n## The Scattered LAPSUS$ Hunters question\n\nSome researchers track CoinbaseCartel under the alias \"shinysp1d3r\" and suggest a connection to ShinyHunters, Scattered Spider and LAPSUS$, the ecosystem known as Scattered LAPSUS$ Hunters. SOCRadar describes this as a contested hypothesis that has not been validated beyond superficial operational overlaps. Halcyon assesses ties based on overlapping techniques, shared affiliate pools and a shared domain, but says there is no confirmed personnel or codebase link to any predecessor group. The link should be treated as unconfirmed.\n\n## Key points\n\n- CoinbaseCartel steals data and extorts victims without encrypting systems; it appeared in mid-September 2025.\n- ransomware.live lists 207 claimed victims as of 19 October 2026, 76 of them in the US, with the latest posting on 23 August 2026.\n- Researchers say raw victim counts are inflated by unverified claims, denials and re-uploads.\n- Reused infostealer credentials are reported as the main access route; the group advertised a $2 million-plus zero-day budget in late 2025.\n- A link to the Scattered LAPSUS$ Hunters ecosystem has been suggested but not confirmed.\n\n## Further reading & sources\n\n- [Ransomware.live: coinbasecartel](https:\u002F\u002Fwww.ransomware.live\u002Fgroup\u002Fcoinbasecartel) (ransomware.live)\n- [Dark Web Profile: CoinbaseCartel](https:\u002F\u002Fsocradar.io\u002Fblog\u002Fdark-web-profile-coinbasecartel\u002F) (SOCRadar)\n- [CoinbaseCartel](https:\u002F\u002Fwww.halcyon.ai\u002Fthreat-group\u002Fcoinbasecartel) (Halcyon)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f",{"actors":18,"malware":39,"timeline":50,"technologies":55},[19,24,28,34],{"url":20,"name":21,"slug":12,"type":10,"origin":22,"motivation":23},"\u002Fthreat-groups\u002Fcoinbasecartel","Coinbase Cartel",null,"financial",{"url":25,"name":26,"slug":26,"type":10,"origin":27,"motivation":22},"\u002Fthreat-groups\u002Fshinyhunters","shinyhunters","Russia",{"url":29,"name":30,"slug":31,"type":32,"origin":33,"motivation":23},"\u002Fthreat-groups\u002Fscattered-spider","Scattered Spider","scattered-spider","cybercrime","United States and United Kingdom (native English-speaking members)",{"url":35,"name":36,"slug":37,"type":10,"origin":38,"motivation":23},"\u002Fthreat-groups\u002Flapsus","LAPSUS$","lapsus","United Kingdom and Brazil",[40,42,44,46,48],{"name":41},"Vidar",{"name":43},"RedLine",{"name":45},"Lumma",{"name":47},"Ransomware",{"name":49},"shinysp1d3r",[51],{"date":52,"event":53,"description":54},"2026-07-15","Listing","PanasonicAero listed by coinbasecartel on leak site",[56],{"vendor":57,"product":58},"Google","Cloud","ransomware_incident","2026-09-18T17:05:03.820479+00:00","2026-10-16T12:28:30.172293+00:00",{"articles":63},[64,76,88,97],{"slug":65,"title":66,"summary":67,"tags":68,"hero_image_url":74,"story_type":59,"created_at":75},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Claims Troutman Pepper Locke Leak as Its Site Lists 64 Law Firms","Silent Ransom Group's leak site listed 64 law firms in August 2026, according to DataBreaches.net, and the group claims it leaked data taken from Troutman Pepper Locke. The firm says an employee was targeted by social engineering and sent documents to an unauthorised party, but that no one gained access to its environment.",[69,70,71,72,73,10],"Silent Ransom Group","Troutman Pepper Locke","law firm","data leak","SSN","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","2026-09-21T17:04:06.647891+00:00",{"slug":77,"title":78,"summary":79,"tags":80,"hero_image_url":86,"story_type":59,"created_at":87},"storm-1175-deploys-new-stormencryptor-ransomware-via-n-central-ncm-auth-bypass","Storm-1175 deploys new StormEncryptor ransomware, likely via N-central auth bypass","Microsoft Threat Intelligence has observed Storm-1175, a financially motivated actor it previously linked to Medusa ransomware, deploying a new C++ ransomware strain called StormEncryptor, with exploitation of the N-able N-central authentication bypass CVE-2026-18577 the likely route in.",[81,82,83,84,85],"StormEncryptor","Storm-1175","N-central NCM","CVE-2026-18577","Medusa","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstorm-1175-deploys-new-stormencryptor-ransomware-via-n-central-ncm-auth-bypass.png?v=316922394f","2026-09-26T07:12:34.821288+00:00",{"slug":89,"title":90,"summary":91,"tags":92,"hero_image_url":95,"story_type":59,"created_at":96},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","N-central auth bypass CVE-2026-18577 exploited; Microsoft links attacks to StormEncryptor actor","Attackers exploited CVE-2026-18577, an incomplete patch for the N-able N-central authentication bypass CVE-2026-18556, to take over N-central servers and reach managed endpoints. Microsoft believes the actor may be Storm-1175, which has switched from Medusa to a new ransomware strain, StormEncryptor.",[93,84,81,47,94],"N-able N-central","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":98,"title":99,"summary":100,"tags":101,"hero_image_url":106,"story_type":59,"created_at":107},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Claims Attack on Saudi Chemical Manufacturer","DragonForce has claimed an attack on a Saudi Arabian chemical manufacturer, listed in AhnLab ASEC's dark web roundup of 16 July 2026. The claim comes from the group itself and has not been independently confirmed. Industry trackers count DragonForce among the most active ransomware operations of Q2 2026, though their victim totals differ.",[102,47,103,104,105],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00"]