ShadowSyndicate
- First seen
- 2021-04-15 00:00:00
- Primary motivation
- financial-gain
- Sophistication
- advanced
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:14:11
Targeted industries: financial-services healthcare-and-pharmaceutical technology-and-telecommunications retail-and-hospitality government-and-public-sector
Context
ShadowSyndicate is a threat actor associated with various ransomware groups, using a consistent Secure Shell fingerprint across multiple servers. They have been linked to ransomware families such as Quantum, Nokoyawa, and ALPHV. ShadowSyndicate's infrastructure overlaps with that of Cl0p, suggesting potential connections between the two groups. Their activities indicate they may be a Ransomware-as-a-Service affiliate.
Reports & references
- group-ib.com — Shadowsyndicate Raas (report)