SOCRadar Profiles CoinbaseCartel’s Credential-Theft and Data-Extortion Operations

May 22, 2026 · Original article ↗

Summary

SOCRadar profiles CoinbaseCartel, an extortion actor reported to steal data using reused credentials and cloud access rather than encrypt systems. Researchers describe its tactics and defenses; proposed links to ShinyHunters, Scattered Spider and Lapsus$ remain ununfirm

Key points

SOCRadar researchers say CoinbaseCartel appeared on September 15–16, 2025. The group has claimed more than 160 victims across 36 countries and 17 industries; these listings do not independently confirm every incident.
The group reportedly uses single extortion: it threatens to publish stolen data without encrypting victims’ systems. Its leak site reportedly sets contact and payment deadlines and added a dataset auction section in early 2026.
Researchers identify reused credentials from infostealer logs as a dominant access method, alongside compromised VPN/RDP credentials, exposed secrets, and OAuth abuse. Links to initial access brokers and insider recruitment are described as inconsistently corroborated.
The article describes bulk data collection using custom Python tooling designed to resemble Salesforce Data Loader activity, followed by staging in compressed archives and exfiltration through cloud services.
Researchers say the group truncates logs, disables syslog forwarding, and changes audit settings to hinder investigation. They also describe lateral movement using administrative tools and remote services.
Recommended defenses include rotating exposed credentials, phishing-resistant MFA, restricting OAuth app permissions, monitoring bulk exports and unusual data transfers, and storing logs immutably.
Researchers have hypothesized links to shinysp1d3r, ShinyHunters, Scattered Spider, and Lapsus$, but the article says attribution beyond superficial overlaps has not been validated.

Article Details

Attack Vectors: CoinbaseCartel reuses credentials from infostealer logs, including credentials harvested by RedLine, Lumma, and Vidar, to access corporate cloud environments, FTP/SFTP endpoints, and managed file transfer services.
The group also uses compromised VPN and RDP credentials and exposed or hard-coded credentials found in code repositories such as GitHub and Bitbucket.
OAuth abuse includes tricking users into authorizing malicious applications, including a modified Salesforce Data Loader, to obtain persistent access to cloud environments.
Researchers link the group to Initial Access Brokers; reported insider recruitment and contractor bribery are not consistently corroborated.
The group collects and exfiltrates data without encrypting victim systems. Reported exfiltration uses AWS, Google Cloud, or Cloudflare, with Tor used in some observed cases.
Defensive Notes: Monitor for exposed employee credentials and rotate credentials associated with infostealer infections; enforce phishing-resistant MFA across cloud, VPN, remote access, and SaaS accounts.
Audit code repositories for hard-coded credentials, API keys, and tokens; use short-lived, automatically rotated secrets.
Restrict third-party OAuth authorization, review existing application grants, and revoke unnecessary permissions that permit broad data export.
Monitor API activity, CRM exports, archive creation, and outbound transfers; use immutable, segregated log storage.
Harden SFTP, FTP, VPN, and RDP access with MFA, IP restrictions where feasible, and authentication monitoring.
Maintain an inventory of sensitive data, test immutable backups, and prepare incident-response plans for extortion without encryption.