Coinbase Cartel ransomware

Coinbase Cartel is a data-extortion crew, not a file-encrypting ransomware: it has not been seen deploying an encryptor against any victim. Systems stay running, files are not renamed and no ransom note is dropped on disk. Victims usually learn of the attack from a direct extortion message backed by samples of their own data, or from their name appearing on the group's Tor leak site with a countdown to publication. Because there is nothing on the affected machines to match, this page cannot be identified from files or notes. The group appeared in September 2025, quickly claimed well over a hundred organizations, and leans toward healthcare, technology and transportation, including a cluster of healthcare providers in the United Arab Emirates. Entry typically comes from credentials harvested by infostealers, initial access brokers or social engineering; the operators then use admin accounts to tamper with logs, compress large archives and pull them out through cloud services. Researchers tie its members to the overlapping Scattered Spider, ShinyHunters and Lapsus$ crews, and it is also tracked under the alias shinysp1d3r.

Decryptor: Decryptor availability has not been recorded. Checked 2026-10-28.

Data exfiltration risk: Confirmed — The group steals data without encrypting it and extorts victims under threat of publication on its Tor leak site, as documented in vendor threat advisories.

Systems typically targeted: Cloud and SaaS tenants, corporate identity accounts and file stores

Do this first: Revoke sessions and rotate credentials for every account seen in infostealer logs, then scope exactly which data stores were accessed for breach notification.