Signalis
sign in--:--:--UTC
Threat actors

Coinbasecartel

☆ pin
Also known as CoinbaseCartel
Reports
26
First seen
May 13, 2026
Last seen
Aug 14, 2026
Motivation
Financial

Relationships

Co-mentioned with Coinbasecartel in 1 Signalis report (co-mention, not confirmed collaboration)×1teampcpReports targeting TechnologyTechnologyReports targeting Professional ServicesProfessional ServicesReports targeting ManufacturingManufacturingCoinbasecartel

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Technology ×10Professional Services ×3Manufacturing ×2Telecommunications ×1Financial Services ×1Healthcare ×1
Victim regions
×1
×10
United States×10
United Kingdom×2
Ireland×1
Japan×1
Argentina×1
France×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1005 Data from Local System ×2T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage ×1T1552.007 Unsecured Credentials: Container API ×1T1567 Exfiltration Over Web Service ×1T1078.004 Valid Accounts: Cloud Accounts ×1T1195.001 Compromise Software Dependencies and Development Tools ×1T1078 Valid Accounts ×1

Indicators

domain ×47hash_md5 ×9hash_sha256 ×9ip_v4 ×6hash_sha1 ×3

Indicator values are available on Pro and via the API.

Recent reports

High

Coinbasecartel claims Turner and Townsend ransomware victim

ransomware.liveHigh

Coinbasecartel claims new victim: Serruya Private Equity

ransomware.liveMedium

Coinbasecartel publishes Sweet Water Holdings as ransomware victim

ransomware.liveHigh

Coinbasecartel claims Hitachi High-Tech victim on ransomware.live

ransomware.liveHigh

Coinbasecartel publishes CEN and Cenelec as ransomware victims

ransomware.liveHigh

Coinbasecartel publishes MIM Fertility as ransomware victim

ransomware.liveHigh

Coinbasecartel publishes M. B. Kahn Construction Co. as ransomware victim

ransomware.liveMedium

Coinbasecartel claims new victim: XS CAD

ransomware.liveMedium

Coinbasecartel publishes Accesso as ransomware victim

ransomware.liveHigh

Coinbasecartel claims new victim: Caterpillar

ransomware.liveHigh

Coinbasecartel claims Colliers Real Estate victim on ransomware.live

ransomware.liveHigh

Coinbasecartel claims Panasonic Avionics Corporation victim on ransomware.live

ransomware.liveHigh

Coinbasecartel publishes Axiom Global as ransomware victim

ransomware.liveMedium

Coinbasecartel claims Demand.io victim on ransomware.live

ransomware.liveHigh

Coinbasecartel publishes Cambridge Mobile Telematics as ransomware victim

ransomware.liveMedium

Coinbasecartel publishes Demand.io as new ransomware victim

ransomware.liveHigh

Coinbasecartel publishes Cambridge Mobile Telematic as ransomware victim

ransomware.liveHigh

Coinbasecartel publishes Cambridge Mobile Telematics as ransomware victim

ransomware.liveHigh

Coinbasecartel claims Siveco as victim on ransomware.live

ransomware.liveHigh

Coinbasecartel claims Openmind Networks victim on ransomware.live

ransomware.liveMedium

Coinbasecartel claims Pragmatic Solutions victim on ransomware.live

ransomware.liveHigh

Grafana GitHub Breach Exposes Source Code via TanStack npm Supply Chain Attack

The Hacker NewsHigh

Grafana GitHub Token Breach Leads to Codebase Theft and Extortion Attempt

The Hacker NewsHigh

Coinbasecartel publishes Zywave as ransomware victim

ransomware.liveHigh

Coinbasecartel publishes Grafana as ransomware victim

ransomware.liveHigh

Coinbasecartel claims Buenos Aires Software victim

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans