Coinbase Cartel
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:26:25
Targeted industries: healthcare-and-pharmaceutical technology-and-telecommunications transportation-and-logistics
Context
Coinbase Cartel is a ransomware threat actor that emerged in September 2025, focusing on data exfiltration rather than encryption, and has claimed over 60 victims, primarily in the healthcare, technology, and transportation sectors. The group employs TTPs such as social engineering, credential harvesting, and collaboration with Initial Access Brokers to gain initial access. They operate a data leak site where they publish victim names and issue ransom demands, requiring payment via Bitcoin.
Reports & references
- businessinsights.bitdefender.com — Coinbase Cartel Ransomware Group Extortion Tactics (report)