Coinbase Cartel: The Credential-Driven Extortion Group Targeting Enterprise Data

In September 2025, a threat group calling itself Coinbase Cartel began surfacing on ransomware leak sites, rapidly accumulating claimed victims across multiple continents. Despite the name, the group has no confirmed affiliation with Coinbase, the cryptocurrency exchange, and the branding appears designed to carry psychological weight rather than signal any technical connection.

What distinguishes this group is not an exotic payload or zero-day exploit chain. The Coinbase Cartel operates through a model that is increasingly common and increasingly difficult to detect: credential theft, quiet network access, and extortion through the threat of data exposure.

What Is the Coinbase Cartel?

The Coinbase Cartel is a financially motivated threat group that reached the top 10 most active extortion groups globally within its first few months. Its operations center on data theft and extortion rather than encryption-based ransomware. Threat intelligence experts attribute the group to affiliates drawn from ShinyHunters, Scattered Spider, and Lapsus$, three well-documented cybercriminal collectives with a shared history of targeting the cloud, social engineering, and large-scale data extortion.

The group's model is direct: obtain valid credentials, access target networks, exfiltrate sensitive data, and demand payment under threat of public exposure.

Leak-site publication serves as the primary enforcement mechanism. Victims receive 48 hours to respond via a designated chat interface, followed by a 10-day window to submit a Bitcoin payment or negotiate terms. If no payment is made, the group publishes the stolen data.

Research by Hudson Rock, cross-referenced against ransomware.live tracking data, identified 164 total claimed victims as of April 2026, with approximately 80% of those organizations having had prior infostealer infections documented in Hudson Rock's Cavalier intelligence database. The group does not use the Ransomware-as-a-Service model; instead, it operates independently and recruits cybercriminals directly.

How Coinbase Cartel operates: The attack lifecycle

The Coinbase Cartel's attack chain is notable for its phase structure in which each step builds on the last using access and tools that, in isolation, can appear entirely legitimate. Unlike other ransomware strains, Coinbase Cartel does not exploit zero-day vulnerabilities, has no custom malware payload, and does not conduct phishing campaigns targeting employees.

Understanding the sequence matters as it determines where detection is possible and where conventional defenses fall short.

Phase 1: Initial access via compromised credentials

Coinbase Cartel uses multiple documented initial access vectors, ranging from passive credential reuse to active social engineering.

The group's primary entry vector is compromised credentials sourced from infostealer malware logs. Infostealers such as RedLine, Lumma, and Vidar harvest saved passwords, session tokens, and authentication data from infected endpoints and upload them to attacker-controlled infrastructure. Those logs are then traded through dark web markets and Telegram channels.

Critically, many of these credentials were years old at the time of the attacks, documented in threat intelligence databases well before the intrusions occurred.

Beyond passive credential reuse, the group has been observed recruiting and bribing third-party contractors with insider access to target environments, a technique that bypasses perimeter controls entirely. The group also employs vishing: voice-based social engineering calls designed to trick employees into approving malicious OAuth application authorizations, granting persistent cloud access without requiring a password.

Phase 2: Persistence

Once inside, the group establishes persistence through multiple mechanisms depending on the environment. In cloud and SaaS environments, persistence is achieved through long-lived OAuth tokens and maliciously connected applications that maintain access despite password resets.

On-premises, the group adds SSH keys and hidden accounts to servers, ensuring continued access even if initial credentials are rotated.

Phase 3: Data discovery and lateral movement

Discovery targets the highest-value assets across the environment, such as VMware datastores, virtual machines, Active Directory objects, and file shares. In cloud environments, vCenter API queries are used to map virtualized infrastructure prior to exfiltration.

Lateral movement between systems is achieved using SSH with root credentials across ESXi hypervisors, and RDP or PsExec in Windows environments.

Phase 4: Data collection and exfiltration

Before any extortion demand is issued, the group identifies and stages high-value data: financial records, customer and client databases, internal communications, and authentication data.

In cloud environments, the group uses custom Python scripts designed to mimic the Salesforce Data Loader, a legitimate enterprise data migration tool, to enable mass exfiltration of CRM data that blends into normal operational traffic. Data is compressed into large archives prior to transfer and exfiltrated via cloud APIs, encrypted channels, or third-party storage services. 

Phase 5: Extortion

Victims are contacted with ransom demands backed by proof-of-access to stolen data. If payment is not made within the designated window, the group publishes the data (or claims to) on dedicated leak sites.

The pressure is primarily reputational and legal, not operational. A confirmed data leak carries disclosure obligations regardless of whether systems remain operational.

Note on encryption: Current Coinbase Cartel operations are exfiltration-only, with no file-encryptors deployed against victims to date.

Targeted sectors and claimed victims

Experts indicate that the healthcare, technology, and transportation industries account for more than half of the group's targets. In December 2025, Coinbase Cartel claimed breaches of 10 major UAE real estate firms, including several internationally recognized agencies. The group's global victim list spans North America, Europe, the Middle East, and the Asia-Pacific region, with named organizations reporting revenues ranging from millions to billions of dollars.

Not all claims have been independently confirmed. NTT Data, a Japanese IT services multinational listed on the group's leak site, publicly denied any data compromise, stating that monitoring was ongoing. Threat actor leak sites serve both extortion and credibility-building functions, and their claims should be treated as unverified until independent forensic triage is completed.

The infostealer ecosystem enabling the Coinbase Cartel model

The Coinbase Cartel's operational effectiveness depends less on its own sophistication than on the broader infostealer ecosystem that supplies it. Malware variants such as RedLine, Vidar, and Lumma Stealer are distributed via malvertising, trojanized software, and phishing campaigns. Once installed on a user's device, it silently harvests credentials and uploads them to an attacker-controlled infrastructure.

Those logs are sorted, packaged, and sold. A threat actor does not need to run its own phishing operation or develop custom malware to gain valid enterprise access since it can purchase that access.

The infostealer-driven credential supply chain means that an organization's attack surface now extends to every employee device, home network, and personal account where work credentials may have been reused or stored.

That exposure is precisely why Amr Fathy, Senior DFIR Engineer at Proven Data, argues that MFA cannot remain a voluntary control: "The system must enforce MFA, not just provide the option. While human errors will persist, the system can limit their impact." Monitoring credential exposure and checking whether organizational accounts appear in known infostealer dumps are now mandatory for enterprise security teams.

The shift toward exfiltration-only extortion

The Coinbase Cartel is part of a structural shift in the extortion landscape. Encrypting data draws immediate operational attention and accelerates the victim's incident response. Groups that abandon encryption entirely extend their dwell time, increase the volume of material available for leverage, and remove the victim's ability to resolve the incident through backup restoration alone.

This model is not unique to Coinbase Cartel. Groups like BianLian moved almost entirely to exfiltration-based extortion. The trend means that organizations managing ransomware and data breach risk must account for incidents in which their response plan is triggered not by an encryption event but by a threat actor contact or a third-party researcher's notification.

Indicators of compromise

Coinbase Cartel operates with a minimal and inconsistent infrastructure footprint. Available reporting does not include stable file hashes, fixed IP addresses, or persistent domain infrastructure.

This reflects the nature of credential-driven intrusion: when an attacker uses valid credentials, their activity is difficult to distinguish from legitimate user behavior using signature-based detection alone.

Detection is more reliably behavioral:

• Anomalous login activity: access from geolocations inconsistent with user history, or from known proxy, VPN, or Tor exit node ranges
• Credential exposure signals: accounts appearing in infostealer dump datasets, accessible through commercial threat intelligence feeds
• Log tampering indicators: gaps or modifications in authentication and access logs, consistent with the group's documented tactic of log file manipulation
• Unusual access patterns: access to sensitive file repositories outside normal working hours, or from accounts not typically accessing those systems
• Data exfiltration indicators: sustained outbound transfers to cloud storage services or unfamiliar endpoints with no established business relationship; large compressed archive creation; high-volume CRM or API export activity

Organizations relying solely on signature-based detection are likely to miss the early stages of this activity.

Confirmed Technical IOCs

MITRE ATT&CK Summary

Security checklist: Defending against credential-based extortion

The following security methods and controls directly address the tactics observed in Coinbase Cartel operations and can also protect against other types of cyberattacks.

Enforce MFA across all remote access points

Make sure passwords across the network, including VPN, RDP, and SaaS application portals, apply multi-factor authentication (MFA).

Deploy credential exposure monitoring

Subscribe to services that index infostealer dumps and alert when organizational credentials appear in leaked datasets. Given that 80% of confirmed victims had prior documented exposure, this is a direct early-warning control.

Audit identity and access management configurations

Review privileged account inventories, service account permissions, and legacy accounts. Consider Identity Threat Detection and Response (ITDR) capabilities as a dedicated control layer.

Audit and restrict OAuth application permissions

Review all connected applications authorized to connect to M365, Google Workspace, or Salesforce tenants. Implement policies requiring IT approval before OAuth apps are connected.

Protect ESXi infrastructure

Disable SSH on ESXi hosts by default; push ESXi logs to a secure, external syslog server; implement snapshot protection policies that prevent unauthorized disablement.

Segment network access by role and function

Network segmentation limits the blast radius of a compromised credential.

Monitor for anomalous authentication events

Establish behavioral baselines and flag deviations: unusual hours, new device fingerprints, geographic anomalies.

Ensure VPN and RDP firmware are updated

Known CVEs in VPN appliances have consistently served as initial access vectors in credential-based intrusions.

Develop an exfiltration-aware incident response plan

Ensure your incident response playbook addresses scenarios in which no encryption occurred but data theft is confirmed or suspected.

Train staff and contractors to recognize vishing

Social engineering calls requesting account actions, application approvals, or credential confirmation are a documented initial access vector for this group.

Implement identity protection controls

Identity protection combines real-time identity threat detection (ITDR), dark web credential monitoring, and behavioral analysis to catch compromised accounts, MFA bypass, and privilege escalation before they become breaches.

How Proven Data can help

The Coinbase Cartel illustrates a threat pattern that is becoming structurally normal: sophisticated access achieved through commodity credential theft, followed by exfiltration-only extortion that bypasses backup-based recovery entirely.

If your organization has received a claim or suspects unauthorized access, Proven Data's 24/7 incident response team is available to assist with immediate triage, forensic investigation, and coordinated response.