sign in--:--:--UTC

Icarus

Also known as mr bean

Reports

18

First seen

Jun 16

Last seen

Jun 25

Motivation

extortion, financial extortion, financial

Targeting

Sectors

technology ×5other ×1financial services ×1

Victim regions

United States ×4

Top ATT&CK techniques

T1005 Data from Local System ×4T1195 Supply Chain Compromise ×4T1041 Exfiltration Over C2 Channel ×3T1078 Valid Accounts ×3T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage ×3T1528 Steal Application Access Token ×3T1566 Phishing ×3T1526 Padding ×2T1059 Command and Scripting Interpreter ×2T1550.001 Use Alternate Authentication Material: Application Access Token ×2T1087 Account Discovery ×2T1592 Gather Victim Org Information ×1

Indicators

domain ×27cve ×9ip_v4 ×8email ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-20253 (exploited)CVE-2026-20262 (exploited)CVE-2026-25089 (exploited)CVE-2026-39808 (exploited)CVE-2026-39813 (exploited)CVE-2026-42824 (exploited)CVE-2026-50160 CVE-2026-50656 (exploited)CVE-2026-8932

Recent reports

ThreatsDay Bulletin: Smart TV Proxyware, curl Vulnerabilities, API Platform Flaws, and Ransomware Trends

The Hacker NewsJun 25 High

LastPass confirms data breach in Klue supply chain attack

Bleeping ComputerJun 23 High

Icarus ransomware gang claims new victim

ransomware.liveJun 23 Medium

Icarus ransomware gang publishes new victim

ransomware.liveJun 23 Medium

Icarus ransomware gang publishes new victim

ransomware.liveJun 23 High

Icarus ransomware claims Huntress as new victim

ransomware.liveJun 22 Medium

Icarus ransomware gang claims HDS (Hdscorp) victim

ransomware.liveJun 22 Medium

Icarus ransomware claims new victim: Gms-net

ransomware.liveJun 22 Medium

Icarus ransomware group claims new victim: Cqcrm

ransomware.liveJun 22 High

Icarus ransomware gang claims Cbassociations victim

ransomware.liveJun 22 High

Check Point Threat Intelligence Report – 22 June 2026

Check Point ResearchJun 22 High

Icarus ransomware publishes victim extortion notice

ransomware.liveJun 20 High

Klue OAuth breach victim list grows as Icarus hackers claim attack

Bleeping ComputerJun 20 High

Icarus ransomware claims Klue.com victim

ransomware.liveJun 19 High

Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data

The Hacker NewsJun 19 High

Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks

Bleeping ComputerJun 18 High

Klue Supply Chain Breach Exposes CRM Data at Huntress and 200+ Companies

Huntress BlogJun 18 Critical

Icarus ransomware publishes TheCreditPros breach: 263MB of PII and payment card data

ransomware.liveJun 16

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans