SpaceBears is a ransomware group that emerged in April 2024, operating as an affiliate within the Phobos ransomware-as-a-service (RaaS) ecosystem, specifically linked to the 'Faust' operator. The group's primary motivation is financial gain, achieved through a double extortion model involving data encryption and exfiltration, followed by threats to publish stolen information. This group distinguishes itself by presenting a corporate image on its leak site, often questioning victims about their data trust, a unique approach for a ransomware operation. They are also noted as a new participant in the 'Data Broker' trend, indicating a broader focus on monetizing stolen data. SpaceBears is assessed with moderate confidence to operate from Moscow, Russia.

Actores similares

APT29 (Cozy Bear)actor · 1Saint Bearactor · 1energetic-bearactor · 1ember-bearactor · 1Energetic Bearapt · 0Boulder Bearapt · 0Pat Bearapt · 0White Bearapt · 0

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker