Skip to content
The Nexus
Group profile27 claimed in last 30d39 total tracked

coinbasecartel

Forward this

CoinbaseCartel specializes in data acquisition through system access and strategic partnerships. It focus exclusively on data exfiltration—our operations never involve system encryption or operational disruption.

First seen: May 30 · 00:00 UTCLast seen: Aug 23 · 21:25 UTCTracked since: 2025-09-15
Sectors hit
  • Technology9
  • Professional Services7
  • Financial Services7
  • Manufacturing5
  • Agriculture and Food Production3
  • Unspecified2
  • Healthcare2
  • Transportation1
Countries hit
  • United States15
  • United Kingdom5
  • Japan2
  • Indonesia2
  • France2
  • Philippines1
  • New Zealand1
  • Israel1
  • Germany1
  • China1
MITRE ATT&CK · observed TTPs7 tactics

Tactics and techniques attributed to COINBASECARTEL by ransomware.live's curated TTP catalog. Identifiers link to the canonical MITRE ATT&CK reference for each tactic or sub-technique.

  • TA0001Initial Access
    • T1078.004Valid Accounts: Cloud Accounts

      Massive focus on credential theft from SaaS platforms (Salesforce, Microsoft 365).

    • T1091Replication Through Removable Media

      Although less common, there are records of attempts via service providers (corrupted insiders/third parties).

    • T1133External Remote Services

      Abuse of VPNs and RDP using credentials harvested by infostealers or purchased from IABs (Initial Access Brokers).

    • T1566.003Phishing: Spearphishing Voice (Vishing)

      Use of voice social engineering to induce employees to authorize malicious OAuth applications.

  • TA0002Execution
    • T1059.004Command and Scripting Interpreter: Unix Shell

      The shinysp1d3r loader is executed via shell scripts on ESXi systems.

    • T1059.006Command and Scripting Interpreter: Python

      Use of custom scripts that mimic legitimate tools (e.g., Salesforce Data Loader) for rapid exfiltration.

    • T1204.002User Execution: Malicious File

      Deceiving users into executing fake OAuth connectors.

  • TA0003Persistence
    • T1098.003Account Manipulation: Additional Cloud Credentials

      Adding new secrets or keys to existing OAuth applications to maintain access even after password changes.

    • T1136.001Create Account: Local Account

      Creation of "ghost" administrator users on VMware hosts.

  • TA0005Defense Evasion
    • T1036.005Masquerading: Match Legitimate Name or Location

      Renaming malicious binaries to names of critical VMware processes or backup tools.

    • T1070.001Indicator Removal: Clear Windows Event Logs

      Systematic cleaning of syslogs and audit logs in ESXi environments.

    • T1562.001Impair Defenses: Disable or Modify Tools

      Disabling virtual machine snapshots before encryption (when they opt for it).

  • TA0007Discovery
    • T1018Remote System Discovery

      Enumeration of Active Directory objects from non-privileged user accounts.

    • T1083File and Directory Discovery

      Scanning vCenter datastores to identify critical VMs and databases.

    • T1538Cloud Service Dashboard

      Exploration of AWS/Azure consoles to identify EBS volumes and S3 instances.

  • TA0010Exfiltration
    • T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

      Use of tools like Rclone to send data to providers such as Mega or Dropbox.

  • TA0040Impact
    • T1486Data Encrypted for Impact

      Secondary technique, focused on .vmdk files via shinysp1d3r loader.

    • T1657Financial Theft

      Direct extortion based on the threat of leaking data on Onion forums (DLS).

Recent claimed victims
Retail & E-CommerceGermanyAug 23 · 21:26 UTC

Westwing Group SE

westwing.com

Westwing Group SE is a German e-commerce company specializing in home and living products. Founded in 2011 and headquartered in Munich, Germany, it operates an online platform offering curated furniture, décor, and lifestyle products. The company serves customers across multiple European markets and combines an inspiration-driven shopping experience with a members-only model, targeting design-conscious consumers seeking premium home furnishings.

HealthcareUnited StatesAug 22 · 14:01 UTC

Integrated Health Systems

ihs911.com
ManufacturingChinaAug 22 · 14:00 UTC

RXPE Group

rxpe.com
Financial ServicesNew ZealandAug 22 · 14:00 UTC

Tower Insurance

tower.co.nz

Tower Insurance is a New Zealand-based insurance company offering a range of personal and business insurance products, including home, contents, car, travel, and commercial coverage. Founded in 1869, it operates primarily in New Zealand and the Pacific Islands. Tower is listed on the New Zealand Stock Exchange and is known for its digital-first approach, providing customers with online policy management and claims services.

TransportationArgentinaAug 22 · 13:59 UTC

Flecha Bus

flechabus.com.ar

Flecha Bus is an Argentine intercity bus company operating in the passenger transportation industry. Founded in the mid-20th century, it provides long-distance coach services connecting Buenos Aires with various provinces across Argentina. Known for offering multiple service categories including standard and premium seating options, Flecha Bus is one of the prominent operators in Argentina's extensive national road transport network.

Professional ServicesFranceAug 22 · 13:58 UTC

OTEIS Conseil & Ingénierie

oteis.fr

OTEIS Conseil & Ingénierie is a French engineering and consulting firm specializing in building and infrastructure design. Operating in France, the company provides technical expertise across disciplines including structural engineering, fluids, electricity, and project management. It serves sectors such as real estate, public works, and urban development, supporting both public and private clients throughout project lifecycle phases.

Financial ServicesAug 22 · 13:57 UTC

Longhorn Investments

longhorninvestments.com
Professional ServicesUnited StatesAug 22 · 13:57 UTC

Kessler Creative

kesslercreative.com
Professional ServicesUnited StatesAug 22 · 13:56 UTC

Klasko Immigration Law Partners

klaskolaw.com

Klasko Immigration Law Partners is a US-based immigration law firm headquartered in Philadelphia, Pennsylvania. The firm specializes in business immigration law, assisting corporations and individuals with employment-based visas, green cards, and compliance matters. It serves multinational companies, healthcare organizations, and academic institutions, providing legal counsel on navigating US immigration regulations and workforce mobility challenges.

United StatesAug 22 · 13:55 UTC

Patel

patelcpaoffice.com

N/A The name "Patel" is too generic to identify a specific company with reliable information. It is a common surname and business name used by numerous unrelated entities across many industries and countries. Please provide additional context such as the full company name, industry, or country to allow for an accurate description.

Financial ServicesAug 22 · 13:54 UTC

Abacus Advisors

abacusadv.com
Financial ServicesPhilippinesAug 22 · 13:54 UTC

LifeBank Microfinance Foundation

lbf.ph

LifeBank Microfinance Foundation is a nonprofit microfinance institution operating in the Philippines. It provides financial services, including small loans, savings programs, and livelihood assistance, primarily to low-income individuals and underserved communities. The organization aims to promote financial inclusion and economic empowerment by offering accessible credit and support to micro-entrepreneurs who lack access to traditional banking services.

Agriculture and Food ProductionIndonesiaAug 22 · 13:53 UTC

PT Perusahaan Jamu Air Mancur

PT Perusahaan Jamu Air Mancur is an Indonesian company operating in the traditional herbal medicine industry. Based in Solo, Central Java, it manufactures and distributes jamu, a traditional Indonesian herbal remedy, along with related health and wellness products. Founded in 1963, the company is one of Indonesia's well-known herbal medicine producers, serving both domestic and export markets across Southeast Asia.

Financial ServicesIndonesiaAug 22 · 13:52 UTC

PT. Bank Perekonomian Rakyat Bintan

PT. Bank Perekonomian Rakyat Bintan is an Indonesian rural bank, known as a Bank Perkreditan Rakyat or BPR, operating in the Bintan regency of Riau Islands province, Indonesia. It provides basic financial services including savings, deposits, and credit facilities primarily to local communities, small businesses, and micro-enterprises. As a rural bank, it operates under supervision of the Indonesian Financial Services Authority, OJK, serving the local economy.

Professional ServicesUnited StatesAug 19 · 15:24 UTC

Crowe

delekus.com

Crowe is a public accounting, consulting, and technology firm headquartered in the United States. It provides audit, tax, advisory, risk, and performance services to clients across various industries, including financial services, healthcare, and government. Crowe operates globally through its membership in Crowe Global, a network of independent accounting and advisory firms spanning over 140 countries.

Professional ServicesAug 19 · 15:23 UTC

Advanced Engineering Consultants

aec-group.org
Professional ServicesUnited KingdomAug 14 · 13:56 UTC

Turner and Townsend

turnerandtownsend.com

Turner and Townsend is a global professional services company headquartered in the United Kingdom. Founded in 1946, it operates in the construction, real estate, infrastructure, and natural resources sectors. The firm provides project management, cost management, and programme management services. It operates in over 50 countries, serving both public and private sector clients across major capital investment programmes worldwide.

Financial ServicesIsraelAug 14 · 13:55 UTC

Serruya private equity

Serruya Private Equity is a Canadian private equity firm based in Toronto, Ontario. Founded by the Serruya family, known for their background in the franchise and consumer goods industry, the firm focuses on investments in consumer brands, retail, and food and beverage sectors. The company acquires and grows established brands, leveraging operational expertise to drive value creation across its portfolio companies in North America.

Agriculture and Food ProductionUnited StatesAug 14 · 13:55 UTC

Serruya private equity

serruyaprivateequity.com

Serruya Private Equity is a Canadian private equity firm based in Toronto, Ontario. Founded by the Serruya family, known for their background in the franchise and consumer goods industry, the firm focuses on investments in consumer brands, retail, and food and beverage sectors. The company acquires and grows established brands, leveraging operational expertise to drive value creation across its portfolio companies in North America.

Agriculture and Food ProductionUnited StatesAug 14 · 13:54 UTC

Sweet Water Holdings

swhco.com
ManufacturingJapanAug 13 · 20:53 UTC

Hitachi High-Tech

hitachi-hightech.com

Hitachi High-Tech is a Japanese technology company headquartered in Tokyo, Japan, and a subsidiary of Hitachi Ltd. It operates in the high-technology and precision equipment industry, specializing in semiconductor manufacturing equipment, analytical and medical instruments, and industrial systems. The company serves sectors including healthcare, electronics, and scientific research, supplying solutions globally across manufacturing and laboratory environments.

OtherBelgiumAug 1 · 05:30 UTC

CEN and Cenelec

CEN (European Committee for Standardization) and CENELEC (European Committee for Electrotechnical Standardization) are European standardization organizations headquartered in Brussels, Belgium. They develop and publish voluntary technical standards across industries including engineering, manufacturing, energy, and electrotechnical sectors. Their standards facilitate trade, safety, and interoperability across European Union and European Economic Area member states.

HealthcareUnited KingdomAug 1 · 05:29 UTC

MIM Fertility

mimfertility.ai

MIM Fertility is a US-based fertility clinic network specializing in reproductive medicine and assisted reproductive technologies. The company provides services such as in vitro fertilization, egg freezing, preimplantation genetic testing, and fertility preservation. Operating within the healthcare and reproductive medicine industry, MIM Fertility focuses on personalized patient care and works with fertility specialists to help individuals and couples achieve pregnancy.

ManufacturingUnited StatesAug 1 · 05:29 UTC

M. B. Kahn Construction Co.

mbkahn.com

M. B. Kahn Construction Co. is a general contracting and construction management firm based in the United States, headquartered in Columbia, South Carolina. Founded in 1926, the company operates primarily across the southeastern United States. It serves sectors including commercial, industrial, healthcare, education, and government markets, delivering services such as design-build, preconstruction planning, and facility construction.

TechnologyUnited KingdomJul 28 · 19:53 UTC

Accesso

Accesso is a UK-based technology company specializing in ticketing, queuing, and guest experience solutions for the leisure, entertainment, and attractions industry. It provides software platforms that help theme parks, ski resorts, cultural venues, and live events manage ticket sales, virtual queuing, and visitor engagement. The company operates globally, serving clients across North America, Europe, and beyond.

Financial ServicesUnited KingdomJul 28 · 19:53 UTC

Accesso

Accesso.Com

Accesso is a UK-based technology company specializing in ticketing, queuing, and guest experience solutions for the leisure, entertainment, and attractions industry. It provides software platforms that help theme parks, ski resorts, cultural venues, and live events manage ticket sales, virtual queuing, and visitor engagement. The company operates globally, serving clients across North America, Europe, and beyond.

ManufacturingUnited StatesJul 20 · 17:56 UTC

Caterpillar

caterpillar.com

Caterpillar Inc. is an American multinational corporation headquartered in Irving, Texas. It is the world's leading manufacturer of construction and mining equipment, diesel and natural gas engines, industrial gas turbines, and diesel-electric locomotives. Operating in over 190 countries, Caterpillar serves industries including construction, mining, energy, and transportation through its equipment, financial services, and aftermarket parts divisions.

Covered · The AtlanticSilicon Valley Has Lost Its Biggest Advantage
Professional ServicesUnited StatesJul 20 · 14:56 UTC

Colliers Real Estate

colliers.com

Colliers International is a global commercial real estate services company headquartered in Toronto, Canada. It operates across more than 60 countries, offering services including property management, investment sales, leasing, valuation, and advisory. The firm serves corporate, institutional, and private clients across office, industrial, retail, and residential property sectors, making it one of the largest real estate services firms worldwide.

ManufacturingJapanJul 15 · 17:01 UTC

PanasonicAero

panasonic.aero

Panasonic Avionics Corporation, commonly known as Panasonic Aero, is a US-based subsidiary of Panasonic Corporation specializing in in-flight entertainment and connectivity systems for commercial airlines. The company designs and supplies seatback screens, Wi-Fi connectivity, and cabin management solutions. Headquartered in Lake Forest, California, it serves major global airlines and operates within the aerospace and aviation technology industry.

United StatesJul 14 · 20:53 UTC

Axiom GlobalNEW

axiomglobal.com
TechnologyUnited StatesJun 12 · 18:51 UTC

Demand.io

Demand.io

Demand.io is a technology company based in the United States that operates in the e-commerce and artificial intelligence space. It develops AI-powered shopping tools and browser extensions designed to help consumers find deals, coupons, and product recommendations while shopping online. The company focuses on enhancing the online shopping experience through data-driven insights and personalized assistance for retail consumers.

TechnologyUnited StatesJun 12 · 18:51 UTC

Cambridge Mobile Telematics

Cambridge Mobile Telematics (CMT) is an American telematics technology company headquartered in Cambridge, Massachusetts. It provides mobile-based driving analytics and safety solutions to insurers, rideshares, fleets, and enterprises. Using smartphone sensors and AI, CMT measures driving behavior to help reduce accidents and improve road safety. Its DriveWell platform is widely used in the insurance telematics industry globally.

TechnologyJun 5 · 19:21 UTC

Demand.ioNEW

Demand.io
TechnologyUnited StatesJun 5 · 19:21 UTC

Cambridge Mobile TelematicNEW

cmtelematics.com

Cambridge Mobile Telematics (CMT) is a US-based telematics technology company headquartered in Cambridge, Massachusetts. It develops mobile sensing and data analytics platforms that measure driving behavior to improve road safety and reduce vehicle crashes. Its technology is used by insurers, rideshare companies, and fleets to assess risk and reward safe driving through usage-based insurance and fleet management solutions.

TechnologyUnited StatesJun 2 · 12:21 UTC

Cambridge Mobile TelematicsNEW

Cambridge Mobile Telematics (CMT) is a US-based technology company headquartered in Cambridge, Massachusetts. It operates in the telematics and insurtech industry, providing mobile sensing and data analytics solutions. CMT specializes in measuring driving behavior using smartphone sensors and AI to help insurers, fleets, and enterprises improve road safety and reduce risk through usage-based insurance and driver safety programs.

TechnologyFranceMay 30 · 14:31 UTC

Siveco -

siveco.com

Siveco is a French software company specializing in computerized maintenance management systems (CMMS) and enterprise asset management (EAM) solutions. Founded in France, the company operates internationally, offering software and services to help organizations manage industrial maintenance, infrastructure, and assets. Its clients span sectors such as energy, transportation, manufacturing, and public utilities across Europe, Africa, and Asia.

TechnologyUnited KingdomMay 30 · 14:24 UTC

Openmind networks

openmindnetworks.com

Openmind Networks is an Irish telecommunications software company specializing in signaling and messaging solutions for mobile network operators. Founded in Dublin, Ireland, the company develops products for SS7, Diameter, and SMS firewall technologies, helping carriers manage and secure signaling traffic. Their solutions address roaming, fraud prevention, and network interoperability, serving telecom operators globally while maintaining headquarters in Ireland.