The ransomware group Coinbase Cartel burst onto the scene in September 2025, claiming 14 victims that month alone. By December, it ranked in Bitdefender’s Top 10 ransomware groups, with over 60 victims in its first few months.
Unlike old-school ransomware that locks up files, this group steals data first and skips encryption. This “data exfiltration” tactic is quieter and faster.
Victims face a stark choice: pay up to keep secrets hidden, or watch them leak online. It’s part of a broader shift in ransomware, as noted in Bitdefender’s reports on its evolution.
Operations and Victim Demographics
Coinbase Cartel steals data but leaves systems running, avoiding noisy encryption. This sparks questions about their goals and possible ties to other hackers.
Like many groups, they stage leaks on dark websites and hit high-profit sectors. Victims range from small firms with millions in revenue to giants with hundreds of billions in revenue.
Healthcare, tech, and transportation make up over 50% of their 2025 targets. Notably, they hit 10 UAE-based healthcare groups in one month a red flag.
Sensitive patient information (PII and PHI) in healthcare fuels identity theft and reputational harm. Is this pure profit, or a geopolitical jab at the UAE economy? The group uses social engineering, stolen credentials from brokers, and admin tools to sneak in, tweak logs, and grab data.
Once the data’s out, they post victim names on their leak site and demand Bitcoin ransoms. Victims get 48 hours to chat, then 10 days to pay or negotiate.
The Data Leak Site and Partnerships
Their site has pages like HOME (showing victim statuses: active, leaking, leaked), AUCTIONS (empty for now), PARTNERSHIPS, and CONTACTS.
They brand themselves as “redefining data extortion”bold words, but not revolutionary. Others, like FunkSec, have also auctioned data, per Bitdefender’s analysis of AI-centric groups.
No Ransomware-as-a-Service (RaaS) model here they go independent, selling stolen data and seeking partners. Last fall, they offered over $2 million for zero-day exploits.
Rumors link them to ShinyHunters, but the proof is thin. Partnerships require proof of hacks, with flexible deals like fixed pay or revenue shares.
Don’t call them a true “cartel” yet no evidence of bullying rivals like DragonForce did, as detailed in Bitdefender’s DragonForce report.
Compared to PEAR (Pure Extraction and Ransom), another data-only group, Coinbase Cartel wins: more victims monthly (beating PEAR’s 45 in late 2025), a wider range of industries (17 vs. 13), and heavier hits on healthcare/tech. Into 2026, they stay stealthy with few OPSEC slips.
Protect yourself with these steps:
- Enforce MFA everywhere, especially admin accounts, and apply least privilege.
- Patch software fast unfixed flaws are easy doors.
- Back up data often, test restores, and store offsite (cloud/external drives).
- Inventory sensitive data: track where it lives, who accesses it, and lock it down.
- Use threat intel for TTP awareness.
- Deploy MDR services like Bitdefender’s for quick detection/response.
- Shrink your attack surface with tools like GravityZone PHASR, which spots living-off-the-land tactics in most high-severity attacks.
Bitdefender tracks Coinbase Cartel and the ransomware scene via monthly Threat Debriefs. Stay vigilant data theft is the new quiet killer.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
