ShadowSyndicate
ShadowSyndicate is a cybercrime cluster first publicly disclosed in 2023 and described as active since at least July 2022. Reporting consistently characterizes it as a shared infrastructure operator rather than a clearly defined single ransomware brand. Multiple sources assess that it most likely functions as an Initial Access Broker (IAB) and/or a bulletproof hosting (BPH) provider, while other reporting describes it as an affiliate across multiple ransomware-as-a-service (RaaS) ecosystems. Its exact role remains unconfirmed. ShadowSyndicate has been linked to a large and expanding server infrastructure using OpenSSH and long-lived access keys, with additional SSH markers and fingerprints connecting dozens of servers to the same operator. Group-IB reported at least 20 servers functioning as command-and-control nodes, while other reporting described dozens of systems, including 52 with SSH fingerprints used as Cobalt Strike beacons. The infrastructure has been associated with open-source post-exploitation tools, red-team frameworks, and offensive tooling including Cobalt Strike, Metasploit, Havoc, Mythic, Sliver, AsyncRAT, MeshAgent, and Brute Ratel. The cluster has been tied to or observed alongside numerous ransomware operations. High-confidence reporting attributes ShadowSyndicate to Quantum ransomware activity in September 2022, Nokoyawa activity in October 2022, November 2022, and March 2023, and ALPHV/BlackCat activity in February 2023. It has also been described as an ALPHV affiliate and as a user of RansomHub. Lower-confidence reporting links it to Royal, Cl0p, Cactus, and Play. Additional reporting notes ShadowSyndicate-linked hosts being used for malicious activity associated with Cl0p, BlackCat, Ryuk, Malsmoke, and Black Basta, and infrastructure connections to malware families including AMOS Stealer and TrueBot. Observed activity includes scanning for vulnerable internet-facing systems, including servers exposed to CVE-2024-23334. Reporting also highlights infrastructure reuse, SSH key rotation and transfer between clusters, and persistent coordination across servers over time. ShadowSyndicate is described as a cybercrime actor, not a nation-state group. One source states it is believed to fuel Russian, North Korean, and Chinese APTs through its access or hosting services, but this is presented as belief rather than confirmed attribution. Known alias in the provided content: ShadowSyndicate.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
10 malware families attributed to this actor across reporting.
5 additional families tracked in Mallory.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A cybercrime activity cluster that has expanded and maintained coordinated SSH-based infrastructure (reused access keys, consistent OpenSSH usage) and operates servers used as C2 nodes for open-source post-exploitation tools and red team frameworks; assessed as potentially functioning as an Initial Access Broker and/or a bulletproof hosting provider.
Cybercrime activity cluster operating shared/reused infrastructure (SSH-keyed server clusters) that supports multiple downstream threat clusters; associated with a broad post-exploitation toolkit and infrastructure handoffs between SSH clusters.
Mentioned only as an additional threat cluster seen in overlapping/shared subnet infrastructure; no further details provided.
Operating as an initial access broker, providing access to various APTs and cybercrime groups, and linked to infrastructure supporting multiple malware and ransomware families.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.