303
Indicators
Properties
- Summary
- Financially motivated group named by Mandiant in October 2020, active since at least 2016. Ran some of the highest-volume phishing campaigns tracked, then shifted in 2019-2020 to ransomware deployment (CLOP) and data-theft extortion. Associated with the exploitation of Accellion FTA zero-days in Dec
- Last source
- CIRCL
- Summary source
- written 2026-10-25 from public vendor reporting (Citizen Lab 2015; Kaspersky/Symantec 2015; Kaspersky 2015; Mandiant 2020); not in ATT&CK
- First seen by Signal
- 2026-09-25T11:10:21+00:00
- Retrieved at
- 2026-10-18T22:16:56+00:00
Related research
- Probably Fine Weekly · the week in advanced persistent threats
Explore this actor's full graph with Ninja Signal