A rapidly expanding ransomware and extortion group known as Coinbase Cartel has officially claimed over 100 targets. The group, which first emerged in September 2025, has made a name for itself through pure data exfiltration and extortion, completely bypassing the use of traditional file encryptors.

While many victim organizations and incident response firms have incorrectly attributed the initial access of these breaches to sophisticated zero-day exploits or complex social engineering, Hudson Rock‘s cybercrime intelligence reveals a different, much simpler reality: Coinbase Cartel exclusively uses old Infostealer credentials to compromise cloud environments, FTP servers, and file transfer services.

The Origin and Operations of Coinbase Cartel

According to historical tracking by Bitdefender, Coinbase Cartel surfaced in late 2025 as part of a growing trend of “extortion-only” operations. By abandoning encryptors, the group ensures that their attacks are quieter and faster, leaving systems fully operational while they silently siphon massive amounts of sensitive corporate data.

In their first few months alone, they skyrocketed to the top 10 most active ransomware groups globally. They specifically target high-revenue organizations in the healthcare, technology, and transportation sectors, banking on the fact that these industries cannot afford the regulatory and reputational fallout of a massive data leak.

The Initial Access Reality: It’s All Infostealers

Despite public statements from breached companies pointing fingers at advanced intrusion methods, our analysis at Hudson Rock confirms that Coinbase Cartel’s playbook is heavily reliant on the underground ecosystem of Infostealer malware (like RedLine, Lumma, and Vidar).

By purchasing or aggregating logs of stolen credentials, the cartel identifies valid employee or contractor logins to corporate Cloud, FTP, and file-sharing infrastructure. Shockingly, these credentials are often years old and were indexed in Hudson Rock‘s database years before the actual ransomware attacks took place.

Case Studies: From Infostealer Log to Ransomware Leak

To further demonstrate this exact pipeline from an employee accidentally downloading an Infostealer to Coinbase Cartel extorting the company, we have highlighted 5 notable examples from the cartel’s recent 100+ target milestone. While we have identified the infostealer credentials attributed to the breaches of many more organizations on their victim list, these 5 case studies clearly illustrate the consistent attack vector. In every instance, the likely credential used for the attack was sitting in our Cavalier database long before the breach occurred.

1. Aptim

Aptim, a major architecture and engineering firm, was breached and actively leaked by the cartel. Our intelligence shows clear historical Infostealer compromises linked to the organization’s infrastructure.

2. Canada Goose

Global fashion brand Canada Goose suffered a significant data leak. The cartel posted proof of the stolen data, which was easily accessible via cloud credentials that were previously compromised. They utilized a very fresh infection data for this attack.

3. Efficy

Efficy, a prominent business services provider, saw 43GB of their data leaked. Once again, the initial access traces back to Infostealer logs.

4. The Epoch Times

Media organizations are not immune. The Epoch Times was successfully targeted, with their exposed credentials heavily documented in our historical records.

5. RAKS

RAKS, a technology firm, was also breached using this identical methodology, transitioning from a seemingly harmless forgotten malware infection to a full-blown corporate data leak.

The Attribution Nightmare: The Cognizant Example

One of the primary reasons organizations fail to identify the root cause of these breaches is the sheer volume of compromised employees. In many cases, victims of Coinbase Cartel had tens of employees infected via infostealers over several years.

When an enterprise has hundreds or thousands of exposed corporate credentials floating around the dark web, attributing the breach to one specific compromised credential becomes incredibly difficult without granular threat intelligence. This is perfectly illustrated in the case of Cognizant, where a multitude of employee infections created a massive attack surface for the cartel to choose from.

Conclusion

The rise of Coinbase Cartel is a stark reminder that the lifespan of an Infostealer log is practically indefinite until those credentials are changed. Threat actors are no longer relying purely on burning expensive zero-days to breach organizations. Instead, they are taking the path of least resistance: exploiting old, forgotten credentials to directly access Cloud and file-sharing infrastructure, bypassing traditional endpoint defenses entirely. We’ve seen similar credentials resulting in tens of millions of dollars paid to groups who used infostealer credentials to hack Change Healthcare.