Overview
CoinbaseCartel specializes in data acquisition through system access and strategic partnerships. It focus exclusively on data exfiltration—our operations never involve system encryption or operational disruption.
What public reporting says
Also known as: shinysp1d3r
- Data-theft-only extortion group, active since September 2025, that does not encrypt systems. Some researchers assess it as an affiliate operation inside the loose Scattered LAPSUS$ Hunters collective (ShinyHunters, Scattered Spider, LAPSUS$); that link rests on overlaps in infrastructure and techniques and is contested.
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
United States of America76
Germany12
United Arab Emirates12
France11
United Kingdom10
Brazil7
Canada7
Indonesia6
Japan4
Belgium4
Exploited vulnerabilities
None recorded in the sources we reviewed.
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
Technique details
Initial Access (TA0001)
- T1078.004 · Valid Accounts: Cloud Accounts: Massive focus on credential theft from SaaS platforms (Salesforce, Microsoft 365).
- T1091 · Replication Through Removable Media: Although less common, there are records of attempts via service providers (corrupted insiders/third parties).
- T1133 · External Remote Services: Abuse of VPNs and RDP using credentials harvested by infostealers or purchased from IABs (Initial Access Brokers).
- T1566.003 · Phishing: Spearphishing Voice (Vishing): Use of voice social engineering to induce employees to authorize malicious OAuth applications.
Execution (TA0002)
- T1059.004 · Command and Scripting Interpreter: Unix Shell: The shinysp1d3r loader is executed via shell scripts on ESXi systems.
- T1059.006 · Command and Scripting Interpreter: Python: Use of custom scripts that mimic legitimate tools (e.g., Salesforce Data Loader) for rapid exfiltration.
- T1204.002 · User Execution: Malicious File: Deceiving users into executing fake OAuth connectors.
Persistence (TA0003)
- T1098.003 · Account Manipulation: Additional Cloud Credentials: Adding new secrets or keys to existing OAuth applications to maintain access even after password changes.
- T1136.001 · Create Account: Local Account: Creation of "ghost" administrator users on VMware hosts.
Defense Evasion (TA0005)
- T1036.005 · Masquerading: Match Legitimate Name or Location: Renaming malicious binaries to names of critical VMware processes or backup tools.
- T1070.001 · Indicator Removal: Clear Windows Event Logs: Systematic cleaning of syslogs and audit logs in ESXi environments.
- T1562.001 · Impair Defenses: Disable or Modify Tools: Disabling virtual machine snapshots before encryption (when they opt for it).
Discovery (TA0007)
- T1018 · Remote System Discovery: Enumeration of Active Directory objects from non-privileged user accounts.
- T1083 · File and Directory Discovery: Scanning vCenter datastores to identify critical VMs and databases.
- T1538 · Cloud Service Dashboard: Exploration of AWS/Azure consoles to identify EBS volumes and S3 instances.
Exfiltration (TA0010)
- T1567.002 · Exfiltration Over Web Service: Exfiltration to Cloud Storage: Use of tools like Rclone to send data to providers such as Mega or Dropbox.
Impact (TA0040)
- T1486 · Data Encrypted for Impact: Secondary technique, focused on .vmdk files via shinysp1d3r loader.
- T1657 · Financial Theft: Direct extortion based on the threat of leaking data on Onion forums (DLS).
Tools
None recorded in the sources we reviewed.
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| System Breach • Coinbasecartel | DLS | fjg4zi4opkxkvdz7mvwp7h6goe4tcby3hhkrz43pht4j3vakhy75znyd[.]onion | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11