coinbasecartel

T1078.004Valid Accounts: Cloud Accounts

Massive focus on credential theft from SaaS platforms (Salesforce, Microsoft 365).

T1091Replication Through Removable Media

Although less common, there are records of attempts via service providers (corrupted insiders/third parties).

T1133External Remote Services

Abuse of VPNs and RDP using credentials harvested by infostealers or purchased from IABs (Initial Access Brokers).

T1566.003Phishing: Spearphishing Voice (Vishing)

Use of voice social engineering to induce employees to authorize malicious OAuth applications.

T1059.004Command and Scripting Interpreter: Unix Shell

The shinysp1d3r loader is executed via shell scripts on ESXi systems.

T1059.006Command and Scripting Interpreter: Python

Use of custom scripts that mimic legitimate tools (e.g., Salesforce Data Loader) for rapid exfiltration.

T1204.002User Execution: Malicious File

Deceiving users into executing fake OAuth connectors.

T1098.003Account Manipulation: Additional Cloud Credentials

Adding new secrets or keys to existing OAuth applications to maintain access even after password changes.

T1136.001Create Account: Local Account

Creation of "ghost" administrator users on VMware hosts.

T1036.005Masquerading: Match Legitimate Name or Location

Renaming malicious binaries to names of critical VMware processes or backup tools.

T1070.001Indicator Removal: Clear Windows Event Logs

Systematic cleaning of syslogs and audit logs in ESXi environments.

T1562.001Impair Defenses: Disable or Modify Tools

Disabling virtual machine snapshots before encryption (when they opt for it).

T1018Remote System Discovery

Enumeration of Active Directory objects from non-privileged user accounts.

T1083File and Directory Discovery

Scanning vCenter datastores to identify critical VMs and databases.

T1538Cloud Service Dashboard

Exploration of AWS/Azure consoles to identify EBS volumes and S3 instances.

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

Use of tools like Rclone to send data to providers such as Mega or Dropbox.

T1486Data Encrypted for Impact

Secondary technique, focused on .vmdk files via shinysp1d3r loader.

T1657Financial Theft

Direct extortion based on the threat of leaking data on Onion forums (DLS).