Loading threat actor…
IntelBroker, also referred to as IntelBrokers, is a financially motivated cybercriminal persona known for stealing, selling, and publicly distributing corporate and government-related data. Public activity dates to late 2022. Targets include technology companies, telecommunications providers, government organizations and contractors, healthcare-related services, and online retailers. IntelBroker has served as a moderator, administrator, and owner of BreachForums, including ownership from August 2024 to January 2025, and was affiliated with CyberN******, a group previously known as The Boys. Collaborators include the actor reported as Sanggiero or Sangierro. IntelBroker's operations emphasize exploitation of security misconfigurations, insecure APIs, exposed development resources, and third-party environments. Documented activity includes exploitation of the Jenkins arbitrary file-read vulnerability CVE-2024-23897 to exfiltrate sensitive data. Other operations involve compromised credentials, access to private repositories, and theft of source code, authentication secrets, internal documents, and personal information. Associated incidents include DC Health Link, PandaBuy, Acuity, Europol's Platform for Experts, and Cisco's DevHub resource. The Europol incident was limited to part of a collaboration portal, while Cisco confirmed exposure of files through a DevHub misconfiguration rather than compromise of its internal systems. Stolen datasets are advertised on underground forums, sometimes with public samples intended to attract buyers. In June 2025, U.S. authorities identified IntelBroker as British national Kai Logan West, also known as Kyle Northern, and unsealed a four-count indictment alleging a data-brokerage operation affecting more than 40 victims and causing over $25 million in damages. West was arrested at his residence in France in February 2025.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family Mallory has associated with this actor across public reporting.
1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).
12 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.