Coinbase Cartel Ransomware: The Credential-Driven Extortion Group Targeting Enterprise Data

More than a year after its emergence, Coinbase Cartel remains a notable example of data-exfiltration extortion that bypasses traditional file-encryption payloads. The leak site has been quiet since August 24, with no sign the group is finished. Credentials and data it already holds don't expire, and its infostealer logs and exposed tokens leave no encrypted files to alert on.

The threat group calling itself Coinbase Cartel began appearing on ransomware leak sites in September 2025, and quickly claimed victims across multiple continents. Public trackers count between 170 and 207 claimed victims, with discrepancies reflecting differences in how leak-site entries are counted.

If your organization has been named or contacted, reach the 24/7 ransomware and breach response team.

Despite the name, the group has no confirmed affiliation with Coinbase, the cryptocurrency exchange, and the branding appears designed to carry psychological weight rather than signal any technical connection. In 2025, attackers targeted the Coinbase company, and its shares fell more than 6%; no relation to the Coinbase Cartel ransomware group has been claimed.

What distinguishes this group from other ransomware strains is not an exotic payload or zero-day exploit chain. Coinbase Cartel operates through an increasingly common, increasingly difficult-to-detect model: credential theft, quiet network access, and extortion through the threat of data exposure.

Coinbase Cartel at a glance

Figures come from public leak-site trackers and vendor reports as of October 21, 2026, and count claimed victims, not confirmed breaches.

What is Coinbase Cartel?

Coinbase Cartel is a financially motivated threat group that reached the top 10 most active extortion groups globally within its first few months. It focuses on data theft and extortion rather than encryption-based ransomware.

The group's model is direct: obtain valid credentials, access target networks, exfiltrate sensitive data, and demand payment under threat of public exposure. It does not use the Ransomware-as-a-Service model; it operates independently. If victims do not pay, it publishes the stolen data (or claims to).

Research published in April 2026 cross-referenced 164 claimed victims against a commercial infostealer database and found that approximately 80% of those organizations had prior infostealer infections.

Skipping encryption is a structural shift. Encrypted systems draw immediate response, while stolen data gives a group pressure that backup restoration cannot remove. BianLian moved almost entirely to exfiltration-based extortion, and organizations managing ransomware and data breach risk must plan for incidents triggered by threat actor contact or a researcher's notification, not an encryption event. Unlike double extortion, which pairs encryption with a leak threat, restoring from backups does nothing against this model.

Who is behind Coinbase Cartel?

Threat intelligence experts have attributed the group to affiliates of ShinyHunters, Scattered Spider, and Lapsus$, three well-documented cybercriminal collectives that overlap in a loose cluster sometimes called Scattered Lapsus$ Hunters. This article calls it the cluster. That is an assessment, not a validated finding, and other analysts offer different explanations:

• Part of the cluster. Supported by the shinysp1d3r alias and overlapping tradecraft, infrastructure, and personnel. Several vendors assess this, but one profile states that attribution beyond superficial overlap has not been validated.
• Rebrand of DataVault, a short-lived operation. Both ran a data-only model using valid accesses obtained through partnerships, and a forum user known as g77 promoted the operation. One firm makes this assessment, and it does not rule out the cluster link. It adds that the operation may not run intrusions itself and may buy access in bulk or monetize data stolen by others, which fits the partnerships page.
• DragonForce offshoot. Early reporting described it as a DragonForce sub-brand, later linked to ShinyHunters; later sources revised this.
• Operator of the shinysp1d3r encryptor. The alias is tied to an ESXi encryptor that actors linked to the cluster were reportedly developing. No use in any attack has been observed.

Is Coinbase Cartel still active?

Coinbase Cartel is quiet but not confirmed dormant. The group has posted in bursts rather than steadily. Tracking data shows 14 listings in September 2025, a peak of 49 in April 2026, then 5 each in June and July before a batch of 24 in August. An assessment published in July described the group as trending toward dormancy, with output falling after the April peak.

A pause should not be read as safety, for three reasons:

• Stolen credentials and tokens do not expire on their own, so access obtained before the pause may still work.
• Data already exfiltrated can be leaked or auctioned at any time.
• Even if the leak site stays quiet, that limits public listings, not private extortion by email or chat.

How the Coinbase Cartel attack unfolds

Each step of the attack chain builds on access and tools that, in isolation, can appear entirely legitimate. The group is not known to exploit zero-day vulnerabilities itself. It has no identified custom malware family beyond exfiltration scripts and deploys no encryptor.

The evidence behind each phase is labeled Observed (seen in Coinbase Cartel cases), Probable (reported for the wider cluster), or Partly observed. Treat anything that is not Observed as a hunting hypothesis, not a finding.

Phase 1: Initial access via compromised credentials

The group's primary entry vector is compromised credentials sourced from infostealer logs. Stealers such as RedLine, Lumma, and Vidar spread through malvertising, trojanized software, and phishing, then harvest saved passwords, session tokens, and authentication data. Attackers sort and sell those logs on dark web markets and Telegram channels, so a threat actor doesn't need its own phishing operation to gain valid enterprise access.

Many of these credentials were years old when attackers used them, and threat intelligence databases documented them well before the intrusions. Attackers test them against cloud environments, FTP and SFTP servers, and managed file transfer services, which often sit outside single sign-on and MFA.

Other entry routes

Secrets exposed in code repositories are a second source. In May 2026, after the group listed the company, Grafana Labs confirmed that an attacker used a compromised token to access its GitHub environment and download source code. Grafana reportedly found no evidence of customer data theft, revoked the token, opened a forensic investigation, and said it would not pay the ransom.

Reporting for the wider cluster also describes recruiting or bribing third-party contractors with insider access, which is not corroborated in Coinbase Cartel cases. Vishing, in which callers trick employees into approving malicious OAuth application authorizations that grant cloud access without a password, is documented for the wider cluster the group is linked to and is assessed as a possible vector here.

Phase 2: Persistence

For the cluster, reporting describes long-lived OAuth tokens and maliciously connected applications that survive password resets in cloud and SaaS environments, and hidden accounts and SSH keys on-premises. This phase is probable, not confirmed, in Coinbase Cartel cases, so recovery should check for it either way.

Stolen session tokens, API keys, and repository tokens work like passwords but fall outside most password policies, so a rotation program must cover them too. Abdelaziz expects attackers to move next toward non-human identities, the accounts no person logs into: API keys, OAuth tokens, service accounts, automation accounts, and remote management agents.

Phase 3: Data discovery and lateral movement

Observed activity centers on administrative account abuse and configuration changes targeting Active Directory objects, file shares, cloud management consoles, and CRM platforms. vCenter API queries, SSH across ESXi hosts, and RDP or PsExec movement are low confidence: one advisory treats this tradecraft as a shared-playbook hypothesis, and some profiles describe no lateral movement at all. Hunt for these behaviors without assuming they occurred.

Phase 4: Data collection and exfiltration

Before demanding payment, the group stages financial records, customer and client databases, internal communications, and authentication data. In cloud environments, custom Python scripts mimic Salesforce Data Loader, a legitimate migration tool, so mass CRM exports blend into normal traffic. Archives move through cloud APIs and trusted cloud platforms, with Tor reported in some cases, in volumes from tens of gigabytes to multiple terabytes.

Phase 5: Extortion

Victims receive demands backed by proof of access, and the data is then published (or claimed to be) on the leak site. The pressure is primarily reputational and legal, not operational: a confirmed leak carries disclosure obligations whether or not systems remain operational.

Evidence and detection by phase

Log tampering can appear in any phase: gaps or modifications in authentication and access logs, bulk truncation, or syslog forwarding switched off. It is reported for the wider cluster.

The infostealer ecosystem enabling the Coinbase Cartel model

Coinbase Cartel's operational effectiveness depends less on its own sophistication than on the broader infostealer ecosystem that supplies it.

Stealers such as RedLine, Lumma, and Vidar are distributed via malvertising, trojanized software, and phishing campaigns. Attackers sort, package, and sell the logs they collect. A threat actor doesn't need to run its own phishing operation or develop custom malware to gain valid enterprise access because it can buy that access.

The infostealer-driven credential supply chain means an organization's attack surface now extends to every employee device, home network, and personal account where employees may have reused or stored work credentials.

That exposure is precisely why Amr Fathy, Senior Digital Forensics and Incident Response (DFIR) Engineer at Proven Data, argues that MFA cannot remain a voluntary control: "The system must enforce MFA, not just provide the option. While human errors will persist, the system can limit their impact." Monitoring credential exposure and checking whether organizational accounts appear in known infostealer dumps should now be a baseline control for enterprise security teams.

Beyond passwords

Old passwords are only part of the supply. Stolen session tokens, API keys, and repository tokens work like passwords but fall outside most password policies, so a rotation program must cover them too.

Magdy Abdelaziz, Head of DFIR at Proven Data, expects attackers to move next toward non-human identities, the accounts no person logs into: API keys, OAuth tokens, service accounts, automation accounts, and remote management agents.

The leak site, pressure tactics, and business model

Two details matter for responders. The auctions page means a listed dataset can be sold before it is published, so a missed deadline is not the only way data reaches other criminals. The partnerships page suggests an operation that buys access and tools rather than builds them.

Targeted sectors and claimed victims

Technology is the most frequently listed sector, followed by financial services, manufacturing, and healthcare. In December 2025, Coinbase Cartel claimed breaches of 10 major UAE real estate firms, including several internationally recognized agencies. Some reports describe this group of UAE victims as healthcare; the original alert and tracker listings show real estate. The global victim list spans North America, Europe, the Middle East, and the Asia-Pacific region, from small firms to large enterprises.

Victim listings on ransomware leak sites represent unverified claims made by the threat actor. Treat them as unconfirmed unless company disclosures, SEC filings, regulatory notifications, or law enforcement confirm them.

How reliable are Coinbase Cartel's victim claims?

Claims against this group have already ended in opposite ways. NTT Data, a Japanese IT services multinational, publicly denied any data compromise and said monitoring was ongoing, while Grafana Labs confirmed a compromise (see Phase 1). If your own organization is listed, see the final section.

Indicators of compromise

Coinbase Cartel's infrastructure footprint is minimal and inconsistent. Available reporting includes no stable file hashes or fixed IP addresses, and when an attacker uses valid credentials, signature-based detection alone is likely to miss the early stages.

Because the attacker may never touch a traditional endpoint, the evidence lives elsewhere. Abdelaziz notes that in cloud extortion cases, the evidence sits in identity logs, API activity, app consent records, and SaaS audit trails, and that "most ransomware investigations eventually become identity investigations." Reviewing cloud forensics coverage before an incident shows which of those logs you actually keep.

Technical indicators

These are contact and leak-site details reported by trackers and advisories. None is a file hash or an infected host address, so they help identify messages and leak-site references, not compromised systems.

MITRE ATT&CK summary

Confidence follows the evidence labels used in the attack chain.

How Proven Data can help

Coinbase Cartel illustrates a threat pattern that is becoming structurally normal: access achieved through commodity credential theft, followed by exfiltration-only extortion that bypasses backup-based recovery entirely.

If your organization appears on the leak site or receives an extortion message, a listing alone is a claim, but plan as if the data is gone and investigate now until forensics shows otherwise. Abdelaziz says that once stolen data appears on a leak site, "the data should be treated as permanently public, and the response becomes a breach-notification and harm-reduction exercise rather than a technical one." Start here:

• Preserve the evidence. Capture the listing, timestamps, extortion messages, and any samples, and coordinate over an out-of-band channel. See how to preserve ransomware evidence.
• Bring in counsel early. Publication frequently starts regulatory clocks, including the GDPR 72-hour rule, state breach laws, HIPAA, GLBA and, for public companies, the SEC's four-business-day disclosure rule, which runs from the materiality determination.
• Revoke, not just reset. Revoke sessions, OAuth grants, API keys, repository tokens and SSH keys, as well as passwords; enforce MFA on file transfer and remote access, and hunt for persistence.
• Scope from identity and cloud logs. With no encryption event, there is no obvious start date. Scope from identity, cloud audit, and egress logs, and prepare customer and partner communications in parallel.

DO NOT PAY THE RANSOM. Decisions about ransom payment carry legal, operational, and financial consequences that should be assessed with qualified legal counsel and an incident response team before any response action is taken. Payment for deletion cannot be verified: when law enforcement dismantled one major ransomware operation's infrastructure in 2024, it found data belonging to victims who had paid for its deletion.

If your organization has received a claim or suspects unauthorized access, Proven Data's 24/7 incident response team can help with immediate triage, forensic investigation, scoping what was taken, and a coordinated response through its incident response services. If you have not been listed, credential exposure monitoring shows whether your accounts already appear in stealer logs.

Disclaimer: This article reflects public intelligence available as of October 2026.