SpaceBears is a ransomware group that emerged in April 2024, operating as an affiliate within the Phobos ransomware-as-a-service (RaaS) ecosystem, specifically linked to the 'Faust' operator. The group's primary motivation is financial gain, achieved through a double extortion model involving data encryption and exfiltration, followed by threats to publish stolen information. This group distinguishes itself by presenting a corporate image on its leak site, often questioning victims about their data trust, a unique approach for a ransomware operation. They are also noted as a new participant in the 'Data Broker' trend, indicating a broader focus on monetizing stolen data. SpaceBears is assessed with moderate confidence to operate from Moscow, Russia.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker