ShadowSyndicate

Reports per quarter

Techniques seen in the last two years

• T1555.003 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2023-3421
• CVE-2023-34362 KEV ransomware
• CVE-2023-4863 KEV
• CVE-2023-5129
• CVE-2024-1708 KEV ransomware
• CVE-2024-1709 KEV ransomware
• CVE-2024-4577 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 6 April 2026

   ShadowSyndicate, a new RaaS player? | Group-IB Blog

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor ShadowSyndicate, a new RaaS player? | Group-IB Blog

2. 31 July 2025

   TLP-CLEAR-31072025-ShadowSyndicate-infrastructure-illumination-EN.pdf

   Malpedia library date Julien DUGAY fromORKL

   Archived copy on ORKL Detailsfor TLP-CLEAR-31072025-ShadowSyndicate-infrastructure-illumination-EN.pdf

3. 24 June 2025

   Cyber%20Threat%20Intelligence%20Report%202025.pdf

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Cyber%20Threat%20Intelligence%20Report%202025.pdf

4. 21 June 2024

   Boolka Unveiled: From web attacks to modular malware | Group-IB Blog

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Boolka Unveiled: From web attacks to modular malware | Group-IB Blog

5. 28 September 2023

   The security pitfalls of social media sites offering ID-based authentication

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor The security pitfalls of social media sites offering ID-based authentication

Newest first. Details opens the report in Explore.