crimew
Attribution profile
- Type
- Sensationalist
- Location
- Russia
- Known incidents
- 6 incidents
- Sources
- 1 source
- First seen
- 2015-04-26
- Last seen
- 2023-01-01
- Updated
- 2026-10-11 00:39
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor, known by the aliases crimew, maia arson crimew, and Tillie Kottmann, is associated with Russia and has targeted US‑based entities including a regional airline, a cloud server holding No Fly and Selectee lists, and organizations using Verkada surveillance systems such as Tesla, Cloudflare, banks, healthcare and correctional facilities. Reported intrusions involve exploiting an unchanged default server password to obtain a 2019 TSA No Fly List and employee personally identifiable information, leveraging a misconfigured AWS server to expose approximately 1.5 million records from US No Fly and Selectee lists, and using exposed DevOps credentials to compromise a Verkada super admin account, gaining unauthorized access to live camera feeds and administrative control. The actor has been indicted by a US grand jury for computer intrusion and identity and data theft and, in the airline incident, cited boredom as the motivation for not probing deeper into the accessed systems.
Incidents
Attributed incidents are available to members.
6 incidentsSources
Sources available to members: 1 source.