Signalis
sign in--:--:--UTC
Threat actors

Fulcrumsec

☆ pin
Also known as FulcrumSec
Reports
3
First seen
Jun 10, 2026
Last seen
Jun 29, 2026
Motivation
Financial

Relationships

CVE-2026-20245, in 1 of Fulcrumsec's report, exploited in the wildCVE-2026-20245CVE-2026-33017, in 1 of Fulcrumsec's report, exploited in the wildCVE-2026-33017CVE-2026-34908, in 1 of Fulcrumsec's report, exploited in the wildCVE-2026-34908CVE-2026-34909, in 1 of Fulcrumsec's report, exploited in the wildCVE-2026-34909Reports targeting OtherOtherReports targeting HealthcareHealthcareReports targeting EducationEducationFulcrumsec

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Other ×1Healthcare ×1Education ×1
Victim regions
Denmark ×1

Top ATT&CK techniques

T1537 Transfer Data to Cloud Account ×1T1566 Phishing ×1T1110 Brute Force ×1T1003 OS Credential Dumping ×1T1078 Valid Accounts ×1T1041 Exfiltration Over C2 Channel ×1T1190 Exploit Public-Facing Application ×1T1592 Gather Victim Identity Information ×1T1195 Supply Chain Compromise ×1

Indicators

cve ×8domain ×2

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-20245 (exploited)CVE-2026-33017 (exploited)CVE-2026-34908 (exploited)CVE-2026-34909 (exploited)CVE-2026-34910 (exploited)CVE-2026-41947 (exploited)CVE-2026-41948 (exploited)CVE-2026-55255 (exploited)

Recent reports

High

Threat Intelligence Report – 29 June: Breaches, AI Threats, and Active Exploits

Check Point ResearchHigh

Fulcrumsec Claims Novo Nordisk Victim on Ransomware.live

ransomware.liveHigh

Fulcrumsec claims Global Schools Foundation as ransomware victim

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans