Sheriff
Attribution profile
- Type
- Criminal
- Location
- Russia
- Known incidents
- 2 incidents
- Sources
- 1 source
- First seen
- 2020-07-06
- Last seen
- 2020-07-06
- Updated
- 2026-10-13 16:32
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Energydrinkkk and Sheriff are aliases used by a Russian‑speaking threat actor who collaborates with the REvil ransomware group. The actor focuses on the financial sector—banks, investment funds, and government agencies—as well as the energy and oil‑and‑gas industry, universities, cybersecurity firms, transportation and cloud‑computing companies, and construction firms. Their primary goal is financial gain, achieved by selling compromised credentials and network access, and by facilitating ransomware deployments. Typical tactics include brute‑force attacks, credential‑stealing malware, and exploiting open remote‑desktop connections to Citrix servers or RDP services to gain initial entry. Notable operations have involved advertising tens of thousands of compromised eToro accounts, offering access to a European construction company and thousands of cPanel accounts, and providing RDP access to an energy company’s Microsoft Online environment that could be used to copy passwords, contacts and internal communications. The actor has interacted with REvil through the gang’s UNKN persona and is described as a top‑tier recruit in the group’s extortion cartel.
Incidents
Attributed incidents are available to members.
2 incidentsSources
Sources available to members: 1 source.