Cyber Threat Actor: Group with No Name (GNN)

Group with No Name, also known as GNN, operates as a threat actor group based in the United States. The group has been publicly linked to at least two cybersecurity incidents targeting Marriott International properties, specifically focusing on a hotel near Baltimore/Washington International Airport in Maryland. Their operations demonstrate a consistent focus on the hospitality sector, with compromised data revealing strategic interest in financial information and corporate operations. During the 2022 breaches, exfiltrated materials included corporate credit card details with CVV codes and expiration dates, flight crew travel reservations, internal business documents, and sensitive employee personnel files. This pattern indicates primary objectives centered on data theft, though no explicit financial demands or ransom motivations were documented in public disclosures.

The group employs social engineering as its primary initial access vector, successfully compromising hotel associates to gain unauthorized access to systems. In both documented cases from May and June 2022, GNN extracted approximately 20 GB of data from a single employee's workstation, suggesting a preference for targeted data harvesting over widespread network intrusion. Marriott's incident reports emphasized that the breaches were contained within hours of detection, with no ransom paid and law enforcement engagement initiated. While GNN publicly criticized the hotel's security practices, their operational impact remained constrained to limited system access compared to potential database-level exposure. The absence of attributed malware families or specialized tooling in available reports suggests reliance on credential exploitation and existing system access rather than deploying custom offensive cyber capabilities.