FulcrumSec
ObscureIQ Threat Intelligence · Actor Profile
FulcrumSecConfidence: High
Data theft / extortion
Motivation: Financial
2Attributed Breaches Circulating
HighAttribution Confidence
Data theft / extortionActor Type
Overview
Specializes in high-speed exfiltration of cloud-hosted data rather than encryption, active since ~September-October 2025 with ~25 claimed victims across 11 countries including Novo Nordisk, LexisNexis, and Avnet. Abuses unrotated API keys, exposed credentials, and misconfigured cloud permissions across AWS, Azure, GCP, and others; uses rclone for transfer.
Tactics, Targeting & TTPs
Abuses unrotated API keys, exposed/hardcoded credentials, misconfigured cloud permissions and over-permissioned identities across AWS, Azure, GCP, MongoDB, Databricks, S3, GitHub/Azure DevOps; uses rclone for transfer.
Source
Attribution draws on public threat-intelligence reporting · Established (multi-source). Primary source →
Were you exposed in one of these breaches?
Check your exposure privately, or request a tailored exposure audit.