Cyber Threat Actor: Sparta Blog

Sparta Blog is an alias used by a threat actor that has been linked to a leak site operating from Russia. The actor’s primary known activity involves publishing data that it claims to have exfiltrated from victim organizations. Public reporting identifies Sparta Blog as the entity behind the leak site where victim data is posted. In one observed case, the actor listed the IT services firm Sercom Informatica SL on that leak site. Alongside the listing, Sparta Blog provided sample files allegedly taken from Sercom’s customers.

The sample material included information from Hospital Puigcerda, a healthcare customer of Sercom Informatica SL. Specific data points visible in the samples were IP addresses, passwords stored in plain text, domain names, subdomains, and staff email addresses. These details pertain to the internal IT environment of the targeted organization and its associated clients. No description of malware, exploit tools, or initial access vectors accompanied the leak site posting. The actor did not respond to outreach attempts from journalists or the affected organizations regarding the disclosure.

Attribution notes place Sparta Blog’s origin in Russia, based on the location information provided in threat intelligence sources. No public evidence connects the actor to a state sponsor, criminal consortium, or specific ransomware affiliate program. The Sercom Informatica SL incident stands as a representative example of the actor’s operational pattern. It illustrates the use of a leak site to expose sensitive data without accompanying ransom demands or extortion notes in the reported material. Consequently, the available information limits the profile to confirmed facts about the alias, location, leak‑site activity, and the observed data exposure.