Activity timeline
REF3076 operator appears in 1 tracked threat between and .
Threat actorTracked since 2026-05
REF3076 operator
Also known as:REF3076MAVERICK operatorsSORVEPOTEL operatorsWater Saci
As of 2026-05-30, REF3076 operator is a threat actor tracked by Threadlinqs Intelligence across 1 threat spanning malware. Also known as REF3076, MAVERICK operators, SORVEPOTEL operators, Water Saci.
- Tracked threats
- 11 high
- First seen
- 2026-05-07
- Last seen
- 2026-05-07
- ATT&CK techniques
- —No mapped techniques yet
- Related CVEs
- 0None referenced