Ransomware needs a way in. Stolen credentials are the cheapest one.
iah6477 Ransomware Group
Ransomware group profile
Description
iah6477 is a financial motivation-driven extortion and ransomware group that surfaced in August 2026. It primarily targets enterprises in the United States, employing double extortion tactics to extract ransom payments while threatening to leak sensitive data online. The group uses sophisticated methods for initial access, including infostealer malware and compromised corporate credentials.
Key insights
- •Targets organizations in the financial services, consumer retail, and technology sectors.
- •Utilizes compromised corporate credentials to gain access to systems.
- •Maintains dark web infrastructure on the Tor network for extortion activities.
- •Exfiltrates large volumes of sensitive data prior to extortion demands.
- •Implements double-extortion tactics by threatening public data leaks.
Threat Level & Status Breakdown
For iah6477 · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for iah6477 in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for iah6477
T1071
Application Layer Protocol
T1562
Impair Defenses
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1021.001
Remote Desktop Protocol
T1080
Taint Shared Content
T1048
T1048
T1539
T1539
T1553
T1553
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
Victims(5)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| proampac | United States | Claimed | 2 days ago | |
| mat-holdings-inc | United States | Claimed | 2 days ago | |
| regencycenters | United States | Claimed | 8 days ago | |
| acima | United States | Claimed | 8 days ago | |
| marvin | Namibia | Claimed | 8 days ago |
Affected countries(2)
Countries where this group has been reported to target or leak victims.