Loading threat actor…
ShadowSyndicate is a cybercrime cluster active since at least 2022 and publicly tracked since 2023. It is most consistently associated with ransomware affiliate activity and shared intrusion infrastructure rather than a distinct, self-contained ransomware brand. Reporting links the cluster with multiple ransomware ecosystems over time, including Quantum, Nokoyawa, ALPHV/BlackCat, RansomHub, and with lower confidence Royal, Cl0p, Cactus, Play, LockBit, Black Basta, and other criminal operations. Security researchers have also assessed that ShadowSyndicate may function as an initial access broker or as a provider of abuse-tolerant or bulletproof infrastructure supporting other actors. The cluster is notable for broad reuse of server infrastructure, persistent SSH- and OpenSSH-related markers, and long-lived operational overlaps across campaigns. Investigations have tied ShadowSyndicate-linked servers to command-and-control activity, OpenVPN infrastructure, and offensive tooling associated with post-exploitation and lateral movement. Observed toolsets and frameworks linked to its infrastructure include Cobalt Strike, Metasploit, Havoc, Mythic, Sliver, Brute Ratel, AsyncRAT, MeshAgent, and other remote access or red-team-style tooling. Infrastructure associated with the cluster has also overlapped with malware distribution or follow-on activity involving TrueBot, AMOS Stealer, and other commodity and intrusion-enabling malware. ShadowSyndicate appears to operate as a service-oriented enabler within the ransomware ecosystem. Multiple reports describe it as an affiliate that has used numerous ransomware families over a relatively short period, suggesting either flexible affiliate relationships or a role supplying access and infrastructure to different ransomware programs. Its infrastructure has been connected to campaigns affecting a wide range of sectors, with observed overlaps in incidents involving enterprise compromise, remote management abuse, credential-based access, and exploitation of exposed services and known vulnerabilities. The actor has been observed scanning for and exploiting vulnerable internet-facing systems, including activity tied to CVE-2024-23334. Tradecraft associated with ShadowSyndicate and its linked infrastructure includes use of SSH-based administration, command-and-control clustering, remote access tooling, repurposed servers, and infrastructure rotation while preserving identifiable operational markers. Researchers have highlighted repeated reuse of access keys and SSH fingerprints across dozens of servers, indicating centralized coordination and durable infrastructure management practices. ShadowSyndicate is not publicly established as a nation-state actor. Available evidence supports classification as a financially motivated cybercrime cluster embedded in the ransomware access-and-infrastructure ecosystem. Known alias usage is limited, and ShadowSyndicate is the primary name used by defenders and researchers.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
14 malware families attributed to this actor across reporting.
9 additional families tracked in Mallory.
39 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as one of several groups linked via Cobalt Strike watermark analysis on BitLaunch infrastructure.
A cybercrime activity cluster that has expanded and maintained coordinated SSH-based infrastructure (reused access keys, consistent OpenSSH usage) and operates servers used as C2 nodes for open-source post-exploitation tools and red team frameworks; assessed as potentially functioning as an Initial Access Broker and/or a bulletproof hosting provider.
Cybercrime activity cluster operating shared/reused infrastructure (SSH-keyed server clusters) that supports multiple downstream threat clusters; associated with a broad post-exploitation toolkit and infrastructure handoffs between SSH clusters.
Mentioned only as an additional threat cluster seen in overlapping/shared subnet infrastructure; no further details provided.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.