SUBJECT PROFILE
Coinbase Cartel is a data-extortion-only group active since September 2025, assessed by Halcyon and Fortinet FortiGuard Labs as an offshoot of the ShinyHunters, Scattered Spider, and LAPSUS$ ecosystems. The group does not deploy ransomware encryption; instead it steals sensitive data and extorts victims under threat of public disclosure, amassing 170+ victims. In the last 48 hours (May 15–18, 2026), the group claimed Grafana Labs after exploiting a misconfigured GitHub Actions workflow to exfiltrate Grafana's entire private codebase.
Data theft and pure extortion (encryption-less); intellectual property and source code theft for leverage
OPERATIONAL HISTORY
GitHub Actions 'Pwn Request' misconfiguration abuse (pull_request_target workflow exploit), privileged token theft and exfiltration, credential theft, CI/CD pipeline abuse, social engineering, data-only extortion (no encryption), leak site victim listing pressure
KNOWN INFRASTRUCTURE
Dedicated data leak/extortion website (105–170 victims listed); GitHub Actions abuse for code exfiltration; no ransomware binary deployment; operates within broader ShinyHunters/Scattered Spider/LAPSUS$ tooling ecosystem