Inside the Coinbase Cartel: How Infostealer Credentials Fueled a 100+ Company Ransomware Spree
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<h1>Inside the Coinbase Cartel: How Infostealer Credentials Fueled a 100+ Company Ransomware Spree</h1>
<p><em>By Hudson Rock Research Team</em></p>
<p>A rapidly expanding ransomware and extortion group known as <strong>Coinbase Cartel</strong> has officially claimed over 100 targets. The group, which first emerged in September 2025, has made a name for itself through pure data exfiltration and extortion, completely bypassing the use of traditional file encryptors.</p>
<p>While many victim organizations and incident response firms have incorrectly attributed the initial access of these breaches to sophisticated zero-day exploits or complex social engineering, <a href="https://www.hudsonrock.com" rel="noreferrer" target="_blank">Hudson Rock</a>‘s cybercrime intelligence reveals a different, much simpler reality: <strong>Coinbase Cartel exclusively uses old Infostealer credentials to compromise cloud environments, FTP servers, and file transfer services.</strong></p>
<img alt="Coinbase Cartel Tor Website Overview" src="https://www.infostealers.com/wp-content/uploads/2026/04/tor_website_overview.png" />
The Coinbase Cartel Tor website overview, proudly displaying their 101 total targets and an ominous warning: “We have all your data.”
<img alt="Coinbase Cartel Victimology List" src="https://www.infostealers.com/wp-content/uploads/2026/04/tor_website_victimology.png" />
A snapshot of the group’s victimology page, featuring global enterprises across multiple sectors with revenues ranging from millions to billions of dollars.
<h2>The Origin and Operations of Coinbase Cartel</h2>
<p>According to historical tracking by <a href="https://www.bitdefender.com/en-us/blog/businessinsights/coinbase-cartel-ransomware-group-extortion-tactics" rel="noreferrer" target="_blank">Bitdefender</a>, Coinbase Cartel surfaced in late 2025 as part of a growing trend of “extortion-only” operations. By abandoning encryptors, the group ensures that their attacks are quieter and faster, leaving systems fully operational while they silently siphon massive amounts of sensitive corporate data.</p>
<p>In their first few months alone, they skyrocketed to the top 10 most active ransomware groups globally. They specifically target high-revenue organizations in the healthcare, technology, and transportation sectors, banking on the fact that these industries cannot afford the regulatory and reputational fallout of a massive data leak.</p>
<img alt="Industries Affected by Coinbase Cartel" src="https://www.infostealers.com/wp-content/uploads/2026/04/bitdefender_industries_Affected_by_coinbasecartel.png" />
Contextual data showing the primary industries targeted by Coinbase Cartel operations during their rapid ascent.
<h2>The Initial Access Reality: It’s All Infostealers</h2>
<p>Despite public statements from breached companies pointing fingers at advanced intrusion methods, our analysis at <a href="https://www.hudsonrock.com" rel="noreferrer" target="_blank">Hudson Rock</a> confirms that Coinbase Cartel’s playbook is heavily reliant on the underground ecosystem of Infostealer malware (like RedLine, Lumma, and Vidar).</p>
<p>By purchasing or aggregating logs of stolen credentials, the cartel identifies valid employee or contractor logins to corporate Cloud, FTP, and file-sharing infrastructure. Shockingly, <strong>these credentials are often years old</strong> and were indexed in <a href="https://www.hudsonrock.com" rel="noreferrer" target="_blank">Hudson Rock</a>‘s database years before the actual ransomware attacks took place.</p>
<div>
<h3>The Hudson Rock Intelligence Correlation</h3>
<p>Through our partnership with <a href="https://www.ransomware.live" rel="noreferrer" target="_blank">Ransomware.live</a>, we cross-referenced Coinbase Cartel’s victim list against our Cavalier database of Infostealer infections.</p>
<div>
<div>
164
Total Victims
</div>
<div>
80%
Victims with Prior Infostealer Infections
</div>
</div>
<div>
<table>
<thead>
<tr>
<th>Company Name</th>
<th>Industry</th>
<th>Revenue</th>
</tr>
</thead>
<tbody>
<tr><td><a href="https://www.hudsonrock.com/search/domain/jbs.com.br" rel="noreferrer" target="_blank">JBS Brazil</a></td><td>Food & Beverage</td><td>$89.9 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/engie.com" rel="noreferrer" target="_blank">Engie</a></td><td>Oil And Gas</td><td>$84.4 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/paccar.com" rel="noreferrer" target="_blank">PACCAR</a></td><td>Manufacturing / Tech</td><td>$31.1 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/correios.com.br" rel="noreferrer" target="_blank">Correios</a></td><td>Transportation</td><td>$28 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/cognizant.com" rel="noreferrer" target="_blank">Cognizant</a></td><td>Tech</td><td>$21.1 Billion</td></tr>
</tbody>
</table>
View Some of the Additional Victims
<table>
<tbody>
<tr><td><a href="https://www.hudsonrock.com/search/domain/cevalogistics.com" rel="noreferrer" target="_blank">Ceva Logistics</a></td><td>Logistics</td><td>$20.2 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/amcor.com" rel="noreferrer" target="_blank">Amcor</a></td><td>Packaging</td><td>$17.4 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/desjardins.com" rel="noreferrer" target="_blank">Desjardin Bank / Group</a></td><td>Bank</td><td>$13.7 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/sktelecom.com" rel="noreferrer" target="_blank">SK-Telecom</a></td><td>Technology</td><td>$13.5 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/balfourbeatty.com" rel="noreferrer" target="_blank">Balfour Beatty</a></td><td>Construction</td><td>$10.6 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/renesas.com" rel="noreferrer" target="_blank">Renesas Electronics</a></td><td>Manufacturing</td><td>$10 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/averydennison.com" rel="noreferrer" target="_blank">Avery Dennison</a></td><td>Manufacturing</td><td>$8.7 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/insight.com" rel="noreferrer" target="_blank">Insight</a></td><td>Tech</td><td>$8.7 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/staples.com" rel="noreferrer" target="_blank">Staples</a></td><td>Retail</td><td>$8 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/ralphlauren.com" rel="noreferrer" target="_blank">Ralph Lauren</a></td><td>Retail</td><td>$7.8 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/commscope.com" rel="noreferrer" target="_blank">Commscope</a></td><td>Technology</td><td>$5.3 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/astim.it" rel="noreferrer" target="_blank">ASTM Group</a></td><td>Infastructure</td><td>$4.5 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/illumina.com" rel="noreferrer" target="_blank">ILLUMINA</a></td><td>Manufacturing</td><td>$4.3 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/sig.biz" rel="noreferrer" target="_blank">SIG.biz</a></td><td>Manufacturing</td><td>$3.9 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/championx.com" rel="noreferrer" target="_blank">ChampionX</a></td><td>Industrial Machinery</td><td>$3.6 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/carters.com" rel="noreferrer" target="_blank">Carters</a></td><td>Retail</td><td>$2.9 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/integer.net" rel="noreferrer" target="_blank">Integer Holdings</a></td><td>Manufacturing</td><td>$1.9 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/precisioncoating.com" rel="noreferrer" target="_blank">Precision Coating</a></td><td>Manufacturing</td><td>$1.8 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/lacoste.com" rel="noreferrer" target="_blank">Lacoste</a></td><td>Fashion</td><td>$1.7 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/canadagoose.com" rel="noreferrer" target="_blank">Canada Goose</a></td><td>Fashion</td><td>$1.3 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/triumphgroup.com" rel="noreferrer" target="_blank">Triumph Group</a></td><td>Aerospace</td><td>$1.3 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/triumph.com" rel="noreferrer" target="_blank">Triumph International</a></td><td>Manufacturing</td><td>$1.3 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/dolby.com" rel="noreferrer" target="_blank">Dolby Laboratories</a></td><td>Manufacturing</td><td>$1.3 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/helzberg.com" rel="noreferrer" target="_blank">Helzberg</a></td><td>Gold And Diamonds</td><td>$1.1 Billion</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/aptim.com" rel="noreferrer" target="_blank">Aptim</a></td><td>Architecture</td><td>$796.5 Million</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/propertyfinder.ae" rel="noreferrer" target="_blank">Propertyfinder / PropSpace CRM</a></td><td>Real Estate Tech</td><td>$614.8 million</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/sgkinc.com" rel="noreferrer" target="_blank">SGK INC</a></td><td>Advertising & Marketing</td><td>$548 Million</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/pellenc.com" rel="noreferrer" target="_blank">Pellenc</a></td><td>Industrial Machinery</td><td>$543.1 Million</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/westwing.de" rel="noreferrer" target="_blank">Westwing Home & Living</a></td><td>Manufacturing</td><td>$470.8 Million</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/gdev.inc" rel="noreferrer" target="_blank">GDEV</a></td><td>Gaming</td><td>$464.5 Million</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/theepochtimes.com" rel="noreferrer" target="_blank">The Epoch Times</a></td><td>News</td><td>$352 Million</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/waynebrothers.com" rel="noreferrer" target="_blank">Wayne Brothers Construction</a></td><td>Construction</td><td>$318 Million</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/posiflex.com" rel="noreferrer" target="_blank">Posiflex</a></td><td>Tech</td><td>$302.4 Million</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/uom.gr" rel="noreferrer" target="_blank">UOM University</a></td><td>Technology</td><td>$297.3 Million</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/studiosus.com" rel="noreferrer" target="_blank">Studiosus Reisen Munchen</a></td><td>Hospitality</td><td>$287.8 Million</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/cinvestav.mx" rel="noreferrer" target="_blank">Cinvestav</a></td><td>Education</td><td>$224.4 Million</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/symeta.com" rel="noreferrer" target="_blank">Symeta</a></td><td>Business Services</td><td>$203.4 Million</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/keb-automation.com" rel="noreferrer" target="_blank">KEB</a></td><td>Manufacturing</td><td>$174.2 Million</td></tr>
<tr><td><a href="https://www.hudsonrock.com/search/domain/pacificairlines.com" rel="noreferrer" target="_blank">Pacific Airlines</a></td><td>Aviation</td><td>$173 Million</td></tr>
</tbody>
</table>
</div>
</div>
<div>
<img alt="Ransomware.live and Hudson Rock Integration" src="https://www.infostealers.com/wp-content/uploads/2026/04/Untitled.png" />
Ransomware.live overview showing the direct correlation between ransomware victims and Hudson Rock’s Infostealer intelligence database.
<img alt="Ransomware.live integration icons" src="https://www.infostealers.com/wp-content/uploads/2026/04/ransomwarelive_icons.png" />
Hudson Rock intelligence natively integrated into ransomware tracking platforms to show compromised domains.
</div>
<h2>Case Studies: From Infostealer Log to Ransomware Leak</h2>
<p>To further demonstrate this exact pipeline from an employee accidentally downloading an Infostealer to Coinbase Cartel extorting the company, we have highlighted 5 notable examples from the cartel’s recent 100+ target milestone. <strong>While we have identified the infostealer credentials attributed to the breaches of many more organizations on their victim list, these 5 case studies clearly illustrate the consistent attack vector.</strong> In every instance, the likely credential used for the attack was sitting in our Cavalier database long before the breach occurred.</p>
<h3>1. Aptim</h3>
<p>Aptim, a major architecture and engineering firm, was breached and actively leaked by the cartel. Our intelligence shows clear historical Infostealer compromises linked to the organization’s infrastructure.</p>
<div>
<img alt="Aptim on Coinbase Cartel Leak Site" src="https://www.infostealers.com/wp-content/uploads/2026/04/aptim0.png" />
Aptim subsequently listed as an ‘Active’ target on the Coinbase Cartel Tor site.
<img alt="Aptim Infostealer Infection in Cavalier" src="https://www.infostealers.com/wp-content/uploads/2026/04/aptim.png" />
SFTP credentials from an employee infected by an Infostealer in 2023 showing in Cavalier.
</div>
<h3>2. Canada Goose</h3>
<p>Global fashion brand Canada Goose suffered a significant data leak. The cartel posted proof of the stolen data, which was easily accessible via cloud credentials that were previously compromised. They utilized a very fresh infection data for this attack.</p>
<img alt="Canada Goose Infostealer Evidence" src="https://www.infostealers.com/wp-content/uploads/2026/04/canadagoose.png" />
Compromised Canada Goose credentials found by Hudson Rock in March 2026.
<div>
<img alt="Canada Goose Tor Listing" src="https://www.infostealers.com/wp-content/uploads/2026/04/canadagoose_tor.png" />
Canada Goose officially listed on the extortion site.
<img alt="Canada Goose Data Proof" src="https://www.infostealers.com/wp-content/uploads/2026/04/canadagoose_proof.png" />
Proof of Canada Goose data exfiltrated by the Cartel.
</div>
<h3>3. Efficy</h3>
<p>Efficy, a prominent business services provider, saw 43GB of their data leaked. Once again, the initial access traces back to Infostealer logs.</p>
<div>
<img alt="Efficy Tor Listing" src="https://www.infostealers.com/wp-content/uploads/2026/04/efficy0.png" />
Efficy’s listing on the extortion portal.
<img alt="Efficy Infostealer Logs" src="https://www.infostealers.com/wp-content/uploads/2026/04/efficy.png" />
Corporate logins for the FTP server of Efficy with the login “partners” captured by Infostealers.
</div>
<img alt="Efficy Leaked Data" src="https://www.infostealers.com/wp-content/uploads/2026/04/efficy_leaked.png" />
The 43GB data leak confirmation for Efficy.
<h3>4. The Epoch Times</h3>
<p>Media organizations are not immune. The Epoch Times was successfully targeted, with their exposed credentials heavily documented in our historical records.</p>
<div>
<img alt="Epoch Times on Leak Site" src="https://www.infostealers.com/wp-content/uploads/2026/04/epochtimes0.png" />
The Epoch Times actively being extorted by Coinbase Cartel.
<img alt="Epoch Times Infostealer Infection" src="https://www.infostealers.com/wp-content/uploads/2026/04/epochtimes.png" />
Infostealer infections associated with The Epoch Times’ admin page admin.epochtimes.com
</div>
<h3>5. RAKS</h3>
<p>RAKS, a technology firm, was also breached using this identical methodology, transitioning from a seemingly harmless forgotten malware infection to a full-blown corporate data leak.</p>
<div>
<img alt="RAKS on Leak Site" src="https://www.infostealers.com/wp-content/uploads/2026/04/raks0.png" />
RAKS listed as ‘Leaked’ on the Coinbase Cartel site.
<img alt="RAKS Infostealer Infection" src="https://www.infostealers.com/wp-content/uploads/2026/04/raks1.png" />
RAKS employee credentials indexed in Cavalier.
</div>
<h2>The Attribution Nightmare: The Cognizant Example</h2>
<p>One of the primary reasons organizations fail to identify the root cause of these breaches is the sheer volume of compromised employees. In many cases, victims of Coinbase Cartel had <strong>tens of employees infected</strong> via infostealers over several years.</p>
<p>When an enterprise has hundreds or thousands of exposed corporate credentials floating around the dark web, attributing the breach to one specific compromised credential becomes incredibly difficult without granular threat intelligence. This is perfectly illustrated in the case of Cognizant, where a multitude of employee infections created a massive attack surface for the cartel to choose from.</p>
<div>
<img alt="Cognizant Infostealer Infection Example 0" src="https://www.infostealers.com/wp-content/uploads/2026/04/cognizant0.png" />
Cognizant victim page on Coinbase Cartel’s Darkweb page.
<img alt="Cognizant Infostealer Infection Example 1" src="https://www.infostealers.com/wp-content/uploads/2026/04/cognizant1.png" />
With thousands of employees infected, narrowing down the exact credential used by Coinbase Cartel requires deep visibility into historical logs.
</div>
<h2>Conclusion</h2>
<p>The rise of Coinbase Cartel is a stark reminder that the lifespan of an Infostealer log is practically indefinite until those credentials are changed. Threat actors are no longer relying purely on burning expensive zero-days to breach organizations. Instead, they are taking the path of least resistance: exploiting old, forgotten credentials to directly access Cloud and file-sharing infrastructure, bypassing traditional endpoint defenses entirely. We’ve seen similar credentials resulting in tens of millions of dollars paid to groups who used infostealer credentials to hack <a href="https://www.infostealers.com/article/single-citrix-compromised-credential-results-in-22000000-ransom-to-change-healthcare/" rel="noreferrer" target="_blank">Change Healthcare</a>.</p>
<div>
<p>To learn more about how Hudson Rock protects companies from imminent intrusions caused by info-stealer infections of employees, partners, and users, as well as how we enrich existing cybersecurity solutions with our cybercrime intelligence API, please schedule a call with us, here:<br />
<a href="https://www.hudsonrock.com/schedule-demo" rel="noreferrer" target="_blank">https://www.hudsonrock.com/schedule-demo</a></p>
<p>We also provide access to various free cybercrime intelligence tools that you can find here:<br />
<a href="https://www.hudsonrock.com/free-tools" rel="noreferrer" target="_blank">www.hudsonrock.com/free-tools</a></p>
<p>Thanks for reading, Rock Hudson Rock!</p>
<p>Follow us on LinkedIn: <a href="https://www.linkedin.com/company/hudson-rock" rel="noreferrer" target="_blank">https://www.linkedin.com/company/hudson-rock</a><br />
Follow us on Twitter: <a href="https://www.twitter.com/RockHudsonRock" rel="noreferrer" target="_blank">https://www.twitter.com/RockHudsonRock</a></p>
</div>
The post Inside the Coinbase Cartel: How Infostealer Credentials Fueled a 100+ Company Ransomware Spree appeared first on InfoStealers.
Article Link: Inside the Coinbase Cartel: How Infostealer Credentials Fueled a 100+ Company Ransomware Spree | InfoStealers