Signalis
sign in--:--:--UTC
Threat actors

Coinbasecartel

☆ pin
Also known as CoinbaseCartel
Reports
42
First seen
May 13, 2026
Last seen
Aug 23, 2026
Motivation
Financial

Relationships

Co-mentioned with Coinbasecartel in 1 Signalis report (co-mention, not confirmed collaboration)×1teampcpReports targeting TechnologyTechnologyReports targeting Professional ServicesProfessional ServicesReports targeting Financial ServicesFinancial ServicesCoinbasecartel

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Technology ×10Professional Services ×7Financial Services ×6Manufacturing ×2Healthcare ×2Telecommunications ×1Other ×1Transport & Logistics ×1
Victim regions
×1
×14
United States×14
United Kingdom×2
Argentina×2
France×2
Indonesia×2
Ireland×1
Japan×1
New Zealand×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1005 Data from Local System ×2T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage ×1T1552.007 Unsecured Credentials: Container API ×1T1078 Valid Accounts ×1T1567 Exfiltration Over Web Service ×1T1195.001 Compromise Software Dependencies and Development Tools ×1T1078.004 Valid Accounts: Cloud Accounts ×1

Indicators

domain ×69hash_md5 ×14ip_v4 ×12hash_sha256 ×10hash_sha1 ×5

Indicator values are available on Pro and via the API.

Recent reports

High

Coinbasecartel claims Westwing Group SE victim on ransomware.live

ransomware.liveHigh

Coinbasecartel publishes Integrated Health Systems as ransomware victim

ransomware.liveMedium

Coinbasecartel publishes RXPE Group as new ransomware victim

ransomware.liveHigh

Coinbasecartel publishes Tower Insurance as new victim

ransomware.liveHigh

Coinbasecartel claims Flecha Bus victim on ransomware.live leak site

ransomware.liveHigh

Coinbasecartel publishes OTEIS Conseil & Ingénierie as ransomware victim

ransomware.liveHigh

Coinbasecartel publishes Longhorn Investments as ransomware victim

ransomware.liveHigh

Coinbasecartel publishes Kessler Creative as ransomware victim

ransomware.liveHigh

Coinbasecartel claims Klasko Immigration Law Partners in ransomware attack

ransomware.liveMedium

Coinbasecartel claims new victim: Patel

ransomware.liveHigh

Coinbasecartel claims Abacus Advisors victim on ransomware.live

ransomware.liveHigh

Coinbasecartel publishes LifeBank Microfinance Foundation as ransomware victim

ransomware.liveHigh

Coinbasecartel publishes PT Perusahaan Jamu Air Mancur as ransomware victim

ransomware.liveHigh

Coinbasecartel claims new victim: PT. Bank Perekonomian Rakyat Bintan

ransomware.liveHigh

Coinbasecartel publishes Crowe as ransomware victim

ransomware.liveHigh

Coinbasecartel publishes Advanced Engineering Consultants as ransomware victim

ransomware.liveHigh

Coinbasecartel claims Turner and Townsend ransomware victim

ransomware.liveHigh

Coinbasecartel claims new victim: Serruya Private Equity

ransomware.liveMedium

Coinbasecartel publishes Sweet Water Holdings as ransomware victim

ransomware.liveHigh

Coinbasecartel claims Hitachi High-Tech victim on ransomware.live

ransomware.liveHigh

Coinbasecartel publishes CEN and Cenelec as ransomware victims

ransomware.liveHigh

Coinbasecartel publishes MIM Fertility as ransomware victim

ransomware.liveHigh

Coinbasecartel publishes M. B. Kahn Construction Co. as ransomware victim

ransomware.liveMedium

Coinbasecartel claims new victim: XS CAD

ransomware.liveMedium

Coinbasecartel publishes Accesso as ransomware victim

ransomware.liveHigh

Coinbasecartel claims new victim: Caterpillar

ransomware.liveHigh

Coinbasecartel claims Colliers Real Estate victim on ransomware.live

ransomware.liveHigh

Coinbasecartel claims Panasonic Avionics Corporation victim on ransomware.live

ransomware.liveHigh

Coinbasecartel publishes Axiom Global as ransomware victim

ransomware.liveMedium

Coinbasecartel claims Demand.io victim on ransomware.live

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans