Jamescarter
Attribution profile
- Type
- Criminal
- Location
- Russia
- Known incidents
- 1 incident
- Sources
- 1 source
- First seen
- 2020-07-08
- Last seen
- 2020-07-08
- Updated
- 2026-10-13 16:14
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Jamescarter, operating under the alias Jamescarter and based in Russia, has been observed selling compromised credential data on dark web markets. The actor’s activity has focused on the ticketing and live‑events sector, exemplified by the sale of 4.8 million email and username records from a UK ticketing provider that affected users mainly in the UK, US, New Zealand, Australia, South Africa, Germany and France. The motive is financial, with the data advertised for $2,500. Observed tactics include using a .ru contact email for the sale and exploiting the victim’s known SQL‑injection vulnerability, as the ticketing site had previously been flagged as susceptible to SQL injection and had suffered website defacement. No public attribution to a state sponsor or criminal consortium has been made, and the reporting does not describe specific malware families or initial‑access vectors. This ticketing‑provider credential sale represents the actor’s most clearly documented operation.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 1 source.