# Coinbase Cartel — Data Exfiltration-Only Ransomware Group Targeting Healthcare, Tech & Transportation

> Coinbase Cartel is a financially motivated cyber-extortion collective that emerged in September 2025, rapidly accumulating 118+ victims across 17 industries by April 2026. Formed from affiliates of ShinyHunters, Scattered Spider, and Lapsus$, the group exclusively exfiltrates data without deploying encryption, operates a dark web leak site with auction capabilities, maintains a $2M+ zero-day acquisition budget, and is actively developing the shinysp1d3r ESXi-targeted ransomware for future double-extortion operations.

- **Published:** 2026-04-06T12:00:00Z
- **Last reviewed:** 2026-04-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0319
- **ID:** TL-2026-0319
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Coinbase Cartel (Russia)
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Coinbase Cartel is a financially motivated extortion collective that first appeared on the dark web in September 2025, claiming 14 victims in its inaugural month. The group is composed of affiliates from well-known threat actor ecosystems including ShinyHunters, Scattered Spider, and Lapsus$, combining their expertise in credential abuse, social engineering, and large-scale data theft.

Unlike traditional ransomware operators, Coinbase Cartel employs a data-theft-first extortion strategy — systematically exfiltrating sensitive data without deploying encryption payloads. This approach makes their intrusions quieter, faster to execute, and significantly harder to detect through conventional ransomware monitoring. Victims are listed on a Tor-hosted data leak site organized into HOME, AUCTIONS, PARTNERSHIPS, and CONTACTS sections, with victim statuses tracked as active, leaking, or leaked.

The group's initial access strategy combines multiple vectors: social engineering campaigns, insider bribery schemes, vishing attacks that trick employees into authorizing malicious OAuth applications, and procurement of access through Initial Access Brokers (IABs). They also acquire exposed credentials and compromise administrative accounts through credential stuffing and reuse attacks.

In cloud environments, Coinbase Cartel leverages custom Python scripts designed to mimic legitimate tools such as the Salesforce Data Loader, enabling mass data exfiltration from CRM systems and cloud APIs without triggering security alerts. For on-premise targets, particularly VMware ESXi infrastructure, the group deploys an in-memory loader called shinysp1d3r that executes via shell scripts on ESXi hosts, retrieving encryptors and launching parallel VMDK encryption while disabling snapshots to hamper recovery efforts. While shinysp1d3r is still under active development as a RaaS offering, its deployment signals an imminent transition to double-extortion capabilities.

Persistence is maintained through long-lived OAuth tokens, creation of hidden accounts, and injection of SSH keys on compromised servers. Defense evasion tactics include disabling syslog forwarding, mass log truncation, and system-wide settings manipulation. The group communicates with victims through a chat interface, providing 48 hours for initial contact and a 10-day deadline for payment negotiation. Payment is accepted exclusively in Bitcoin.

Coinbase Cartel operates a non-RaaS business model but actively recruits partners who can demonstrate evidence of successful compromises, offering flexible compensation through fixed-rate agreements or revenue-sharing models. In October 2025, the group announced a zero-day acquisition budget exceeding $2 million, signaling advanced operational capability and sustained investment in offensive tooling.

By December 2025, Coinbase Cartel ranked among Bitdefender's Top 10 Ransomware Groups. As of April 2026, the group has claimed 118+ victims spanning 17 industries, with Technology (39 victims), Transportation/Logistics (8), Financial Services (8), Manufacturing (8), and Consumer Services (8) representing the most impacted sectors. Geographically, the United States leads with 34 victims, followed by the UAE (12), Germany (9), Canada (6), and France (6). Notably, the group breached 10 UAE healthcare organizations in a single month, demonstrating both the scale and sector-specific focus of their operations. High-profile victims include Illumina, SK Telecom, Staples, JBS Brazil, CEVA Logistics, Kuehne + Nagel, and Dolby Laboratories.

The 39.2% infostealer correlation rate among victims suggests Coinbase Cartel may leverage infostealer-harvested credentials as an initial access vector, further complicating attribution and detection efforts.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1090 Proxy
- T1528 Steal Application Access Token
- T1580 Cloud Infrastructure Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [No Encryptors, No Problem: The Coinbase Cartel Ransomware Group](https://www.bitdefender.com/en-gb/blog/businessinsights/coinbase-cartel-ransomware-group-extortion-tactics)
- [Coinbase Cartel Prioritizes Data Theft in Targeted Extortion Campaign](https://cyberpress.org/coinbase-cartel-steals-first/)
- [Coinbase Cartel Ransomware - FortiGuard Threat Actor Profile](https://www.fortiguard.com/threat-actor/6386/coinbase-cartel-ransomware)
- [New Threat Actor: Coinbase Cartel - Joe Shenouda](https://www.shenouda.nl/new-threat-actor-coinbase-cartel/)
- [Threat Intelligence Report September 16-22, 2025 - Red Piranha](https://redpiranha.net/news/threat-intelligence-report-september-16-september-22-2025)
- [Ransomware.live CoinbaseCartel Tracker](https://www.ransomware.live/group/coinbasecartel)
- [WatchGuard Coinbase Cartel Ransomware Tracker](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/coinbase-cartel)
- [Coinbase Cartel Targets High-Value Sectors with Data-Theft-First Strategy](https://cybersecuritynews.com/coinbase-cartel-targets-high-value-sectors/)
- [Coinbase Cartel Shifts to Data-Theft-First Tactics](https://gbhackers.com/coinbase-cartel-shifts-to-data-theft/)
- [New Cybercriminal Group Targeting Transportation and Logistics Industry](https://www.fisherphillips.com/en/insights/insights/new-cybercriminal-group-targeting-transportation-and-logistics-industry)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0319