Cyber Threat Actor: Cyclops

Cyclops is a ransomware group that operates under the alias Cyclops and has been linked to Russia based on available information. The group presents itself as a relatively new ransomware operation and has been observed using an affiliate model, wherein attacks are carried out by affiliated actors rather than the core group directly. A spokesperson identifying themselves as “Booda” communicated with victims and journalists via the Qtox messaging platform to discuss the incidents and provide proof of data theft.

The group’s observed activity focuses on the healthcare sector, with the only publicly reported incident targeting a medical clinic in Australia. Their strategic objective appears to be financial gain, achieved through the exfiltration of sensitive personal and health information followed by threats to publish the data unless a ransom is paid. Tactics noted in the incident include deploying ransomware to encrypt systems, stealing data such as patient names, dates of service, test types, and doctors’ banking details, and then publishing the stolen material online. The stolen files were password‑protected PDFs, and the group communicated with the victim and media through Qtox to negotiate and provide evidence of the breach.

The most significant campaign attributed to Cyclops occurred on June 29 2023 when the group claimed responsibility for the cyberattack on Atherfield Medical & Skin Cancer Clinic. The breach resulted in the unauthorized access of the clinic’s network, the exfiltration of a substantial volume of protected health information, and the subsequent release of that data on a public leak site. The clinic engaged forensic specialists, began notifying potentially affected individuals, and worked to secure its systems while the investigation remained ongoing. This event represents the primary publicly documented operation through which Cyclops’s capabilities and methods have been observed.