Threat Group Profile
coinbasecartel
● Active — last 30 days
Victim claims
59
First seen
Apr 2026
Last activity
12 Jun 2026
Tracked since
Sep 2025
Group overview
CoinbaseCartel specializes in data acquisition through system access and strategic partnerships. It focus exclusively on data exfiltration—our operations never involve system encryption or operational disruption.
Preferred targets
Technology · 16
Business Services · 11
Consumer Services · 6
Manufacturing · 4
Education · 3
Energy · 3
Most targeted countries
US · 26
FR · 5
BR · 3
GB · 2
ID · 2
DE · 2
Tactics & techniques (MITRE ATT&CK)
Initial Access
Valid Accounts: Cloud Accounts
Replication Through Removable Media
External Remote Services
Phishing: Spearphishing Voice (Vishing)
Execution
Command and Scripting Interpreter: Unix Shell
Command and Scripting Interpreter: Python
User Execution: Malicious File
Persistence
Account Manipulation: Additional Cloud Credentials
Create Account: Local Account
Defense Evasion
Masquerading: Match Legitimate Name or Location
Indicator Removal: Clear Windows Event Logs
Impair Defenses: Disable or Modify Tools
Discovery
Remote System Discovery
File and Directory Discovery
Cloud Service Dashboard
Exfiltration
Exfiltration Over Web Service: Exfiltration to Cloud Storage
Impact
Data Encrypted for Impact
Financial Theft
