Cyber Threat Actor: Xanthe Group

Xanthe Group is an alias usedby a threat actor that has been publicly linked to a cyber attack against a German company. The actor’s known location, if any, is indicated as Germany. The group is described in open sources as a professional group that specializes in targeting corporate entities. No further details about its size, structure, or internal organization are available in the referenced material.

The only publicly reported operation attributed to Xanthe Group occurred on December 31, 2019, targeting Canyon Bicycles GmbH. During the Christmas period the attackers compromised the company’s IT systems and encrypted portions of its software and servers. The public website and ordering functionality remained operational despite the encryption. The intrusion led to processing delays for customer orders while core systems were subsequently secured. Authorities including criminal investigation departments and data protection officials were notified, and criminal charges were filed against the perpetrators. Cybersecurity experts conducted an analysis of the breach and implemented countermeasures after the incident.

The observed tactics in this incident include the use of encryption to disrupt internal systems, although specific malware families or initial access vectors are not disclosed. No tooling style, command‑and‑control infrastructure, or post‑exploitation tools are mentioned in the source material. Attribution to any state sponsor, criminal consortium, or other affiliations has not been established publicly for Xanthe Group. The Canyon Bicycles case stands as the sole representative campaign that has been reported in open sources. Consequently, the profile of Xanthe Group is limited to the alias, the indicated geographic nexus, and the details of this single verified attack.