IntelBroker
Attribution profile
- Type
- Criminal
- Location
- Russia
- Known incidents
- 4 incidents
- Sources
- 4 sources
- First seen
- 2023-01-05
- Last seen
- 2023-09-06
- Updated
- 2026-10-10 20:00
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
IntelBroker is a threat actor known by the alias IntelBroker, with reported ties to Russia. The actor has targeted government entities, healthcare providers, retail services and telecommunications companies, primarily seeking financial gain by selling stolen data for Monero cryptocurrency on underground forums. Observed tactics include exploiting insecure third‑party vendor cloud storage to obtain customer records, compromising web‑portal applications to exfiltrate documents, and advertising the stolen data on hacking forums for sale. No specific malware families or toolsets are described in the source material. Public attribution does not link IntelBroker to a state sponsor or criminal consortium beyond the geographic hint of Russia. Representative operations cited in reporting are the September 2023 breach of Europol’s Platform for Experts portal, the March 2023 DC Health Link incident affecting U.S. House members, the February 2023 Weee! grocery service leak, and the January 2023 telecommunications‑vendor compromises that exposed tens of millions of consumer records.
Incidents
Attributed incidents are available to members.
4 incidentsSources
Sources available to members: 4 sources.