Attribution
Unattributed to any nation-state or named individual. Multiple vendors (Bitdefender, Hudson Rock, SOCRadar) assess the operation is run by affiliates drawn from the English-speaking 'Com' cybercriminal ecosystem, citing overlaps with ShinyHunters, Scattered Spider and Lapsus$ tradecraft (credential/infostealer-driven access, social engineering, pure data extortion). These links are analytic overlaps, not confirmed identity. Despite the name, no reporting establishes any affiliation with Coinbase the cryptocurrency exchange or with the 2025 Coinbase insider data-breach extortion incident; the 'Coinbase' branding appears to be psychological/theatrical rather than a real connection.
Sectors
Real estate, financial services, professional services, technology