NightLion

Profile narrative

NightLion is a threat actor known by the alias NightLion and is located in the United States of America. Public reporting ties this actor to a breach that occurred on July 13 2020, in which they gained unauthorized access to DataViper, a data leak monitoring service operated by Night Lion Security. During the incident the actor exfiltrated more than 8,200 databases that contained information compiled from historical breaches affecting billions of users. The actor subsequently posted detailed evidence of the compromise, including JSON samples and proof of access, on a dark web portal. The service’s operator acknowledged that a test environment had been accessed but disputed claims that sensitive data had been stolen, suggesting the intrusion was intended to damage reputation rather than to acquire valuable information.

The only confirmed target of NightLion is a security firm’s data leak monitoring service, placing the activity within the cybersecurity services sector. No additional sectors, geographic regions, or strategic objectives such as financial gain, espionage, or disruption are explicitly stated in the available sources, so those aspects are not included here. Regarding tactics, techniques, and procedures, the reporting notes that the actor accessed a test environment, extracted databases, and published the stolen material on a dark web forum; no specific malware families, initial‑access vectors, or tooling styles are described. Attribution to any state sponsor or criminal consortium has not been established; while the victim speculated about possible links to groups like TheDarkOverlord and ShinyHunters, those assertions remain unverified and are therefore omitted. Consequently, the DataViper breach represents the sole publicly documented operation attributed to NightLion, and no further campaigns or activities are known from the provided material.

Incidents

Attributed incidents are available to members.