Return

Profile narrative

Return, also known as Return Team, is a threat actor identified in open‑source reporting as being of Russian background. The actor operates under the alias Return and has been linked to a single publicly reported intrusion that occurred in August 2016. No additional aliases or organizational structure are described in the available sources, and the actor’s exact location within Russia is not specified beyond the background attribution.

The observed activity of Return shows a focus on financial gain through the theft and sale of sensitive personal data. In the reported case, the actor targeted a Baltimore‑based addiction treatment clinic, a healthcare organization located in the United States, and sought to monetize the stolen patient database by offering it for sale on a dark web forum and demanding a ransom of 15 Bitcoin. The actor’s strategic objective appears to be purely monetary, as evidenced by the ransom demand and the attempt to sell the data after the victim declined to pay. No indications of espionage, disruption, or ideological motives are present in the source material.

The tactics, techniques, and procedures demonstrated by Return in this incident include social engineering to persuade an employee to open a malicious Word file, which served as the initial access vector. Once the file was opened, a loader was deployed onto the victim’s system, enabling the actor to exfiltrate the patient database. The actor then used a dark web marketplace, specifically the crdclub.su forum, to advertise the stolen data and negotiate payment. This single campaign resulted in the compromise of 860 individuals’ records, including names, Social Security numbers, medical treatment details, and other personally identifiable information, and was subsequently reported to federal health authorities by the victim organization. No further campaigns or affiliations with state actors or criminal consortia are documented in the provided information.

Incidents

Attributed incidents are available to members.