GS7

Profile narrative

GS7, also known by the alias GS7, is a financially motivated threat actor. The actor primarily targets Fortune 500 companies in the financial, insurance and technology sectors. Its strategic objective is to generate illicit revenue through the sale of compromised access. Public reporting links GS7 to a cryptocurrency wallet that received approximately 0.28 BTC during its activities.

The most publicly documented operation attributed to GS7 is Operation DoppelBrand, which ran from December 2025 through January 2026. It involved phishing emails that directed victims to lookalike domains hosting cloned login portals of legitimate services, with firms such as USAA among the targets. Harvested credentials, together with IP addresses, geolocation and device details, were exfiltrated to attacker‑controlled Telegram bots. After obtaining access, the actor deployed legitimate remote monitoring tools to establish persistent, unattended access on compromised systems. This access was then used to act as an initial access broker, selling the compromised accounts to affiliated threat actors.

The campaign’s infrastructure relied on automated domain registration, short‑lived SSL certificates and Cloudflare hosting. These components enabled the rapid creation of subdomains and the distribution of the fraudulent sites used in the operation. This technical setup supported the large‑scale phishing effort observed during Operation DoppelBrand.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 0 sources.