FulcrumSec
FulcrumSec is a financially motivated data-theft and extortion actor, described in the content as a ransomware group focused on data extortion and active since at least September 2025. The group publicly claims intrusions, publishes detailed breach reports, and operates a Tor/dark web leak presence and underground forum postings to pressure victims. Known alias in the content: FulCrumSec. Across the cited incidents, FulcrumSec primarily targets organizations by stealing data from cloud and application environments and then leaking or threatening to leak it. Reported victims and claimed targets in the content include Arup Group, LexisNexis Legal & Professional, Wound Technology Network (Woundtech), Unique Computing LLC, ReFocus AI, Gennet AI, Lena Health, a California-based mortgage broker, and a healthcare breach referenced by Bitdefender. The group’s claimed tradecraft in the content centers on exploitation of exposed or unpatched internet-facing applications and abuse of cloud credentials and secrets. Specifically mentioned techniques include exploiting the React2Shell vulnerability/CVE-2025-55182 in unpatched React frontend applications; obtaining access via a GitHub personal access token hardcoded in a JavaScript file on a forgotten subdomain; harvesting additional hardcoded tokens, API keys, passwords, and cloud credentials from repositories; abusing ECS/container credentials and overly permissive AWS roles; accessing AWS infrastructure including S3 buckets, Redshift, VPC databases, AWS Secrets Manager, and Qualtrics; and exfiltrating large datasets from cloud storage and databases. The content also describes FulcrumSec publishing detailed victim narratives, contacting victims during extortion, and in some cases releasing data publicly for free when negotiations failed. The content does not attribute FulcrumSec to any nation state. It consistently portrays the actor as criminally motivated and focused on data theft/extortion rather than espionage. No sub-groups are directly identified in the provided content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Capital Goods
- Software & Services
Where they target
Geographies tied to known operations.
- 🇬🇧 United Kingdom
- 🇭🇰 Hong Kong SAR China
Tradecraft
24 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Observables
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Financially motivated data-theft-extortion group active since September 2025 that specializes in rapid exfiltration of cloud-hosted data by exploiting unrotated API keys, hardcoded credentials, and misconfigured cloud permissions. In this case, it claimed a long-running, targeted intrusion against Arup Group, stealing GitHub repositories, cloud storage data, and database backups before attempting extortion.
Conducted a data breach and public leak operation against Unique Computing, ReFocus AI, and Gennet AI by exploiting a public-facing application flaw to obtain ECS credentials, access shared AWS resources, and exfiltrate 140GB of data for public release.
Conducted a data theft and extortion operation against Woundtech, exfiltrating medical data from Snowflake exports and an S3 bucket, publishing leak previews, negotiating payment, and offering to redact or delete some patient data before public release.
A threat actor advertising an alleged large-scale breach of a California-based mortgage broker, claiming theft of mortgage application documents, source code, credentials, and financial infrastructure data.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.