coinbasecartel Ransomware
Tracked since Sep 15, 2025
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
CoinbaseCartel specializes in data acquisition through system access and strategic partnerships. It focus exclusively on data exfiltration—our operations never involve system encryption or operational disruption.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078.004 Valid Accounts: Cloud AccountsT1091 Replication Through Removable MediaT1133 External Remote ServicesT1566.003 Phishing: Spearphishing Voice (Vishing) Execution
T1059.004 Command and Scripting Interpreter: Unix ShellT1059.006 Command and Scripting Interpreter: PythonT1204.002 User Execution: Malicious File Persistence
T1098.003 Account Manipulation: Additional Cloud CredentialsT1136.001 Create Account: Local Account Defense Evasion
T1036.005 Masquerading: Match Legitimate Name or LocationT1070.001 Indicator Removal: Clear Windows Event LogsT1562.001 Impair Defenses: Disable or Modify Tools Discovery
T1018 Remote System DiscoveryT1083 File and Directory DiscoveryT1538 Cloud Service Dashboard Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Impact
T1486 Data Encrypted for ImpactT1657 Financial Theft Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live