Cyber Threat Actor: CocaineSecurity

The threat actorknown by the alias CocaineSecurity has been observed operating from Russia. The only publicly reported activity linked to this alias is a distributed denial‑of‑service attack that occurred on 6 November 2015 against Swedbank, a major Scandinavian financial institution. During the incident the bank’s public website became unable to process online transactions, while its mobile applications and payment systems continued to function normally. Customers could still view their accounts through a specific URL but were unable to execute any transfers or payments via the web portal. Swedbank officials noted that the attack marked the second cyber incident targeting the bank within a short period, following an earlier hack in October of the same year. The institution anticipated further disruptive attempts and worked to restore full website functionality as quickly as possible.

No additional details about the actor’s tools, malware families, or initial access vectors have been disclosed in the available sources, so specific TTP themes cannot be confirmed. The attack’s nature—overwhelming web traffic to deny service—indicates a disruption‑oriented objective rather than data theft or espionage. The only known target of CocaineSecurity is Swedbank, a financial institution located in Sweden. Because no public statements have linked CocaineSecurity to a state sponsor, criminal consortium, or any other affiliate group, any assertion about affiliation remains unsupported by evidence. Consequently, the actor’s broader campaign history, strategic goals beyond this single incident, and geographic focus beyond the observed Swedish target are unknown. The profile therefore rests exclusively on the confirmed facts of the alias, its Russian location, and the documented DDoS against Swedbank.