ChatVPN
Attribution profile
- Type
- Criminal
- Location
- United States of America
- Known incidents
- 1 incident
- Sources
- 0 sources
- First seen
- 2021-02-26
- Last seen
- 2021-02-26
- Updated
- 2026-10-12 11:18
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
ChatVPN, also known by its alias, is a threat actor group believed to originate from the United States. The group has been linked to a data breach and potential ransomware attack against a US‑based company, where confidential information was compromised and data was exfiltrated from both end‑user devices and application servers. The incident, reported in February 2021, was described as having likely financial or ideological motives, indicating the actors’ strategic objectives. No specific malware families, initial access vectors, or tooling styles are detailed in the available source, and no state sponsorship or criminal‑consortium affiliations have been publicly established for ChatVPN. The February 2021 breach represents the group’s only publicly reported operation to date.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 0 sources.