Cyber Threat Actor: CyberNiggers

The threat actor known as CyberNiggers operates primarily in France, with its activities publicly documented in at least one significant incident. This group targets third-party service providers within the cultural sector, as evidenced by their compromise of Forum Sirius—a ticketing software vendor used by Théâtre de la Cité internationale in Paris. Their operations focus on breaching organizational infrastructure to extract sensitive user data, though no explicit financial or ideological motives are declared in available reports. The absence of additional aliases or collaborator groups in open sources suggests this entity operates under a single identified moniker.

CyberNiggers demonstrates a consistent pattern of targeting supply chain vulnerabilities, specifically attacking software providers whose systems grant access to multiple downstream clients. In the June 2024 Forum Sirius incident, they obtained server credentials to compromise names, contact details, and passwords of theater patrons. This credential-based initial access vector indicates a preference for exploiting authentication weaknesses rather than deploying malware payloads. The operational security measures taken by the group remain unspecified, though their success in exfiltrating data suggests deliberate reconnaissance of the provider’s infrastructure. No tooling patterns beyond credential theft are referenced in connection with this actor.

The group’s singular publicly reported operation against Forum Sirius illustrates their impact on cultural institutions and their audiences. By compromising a centralized ticketing platform, the attack potentially affected multiple venues relying on the provider’s services, though only the Parisian theater’s breach was confirmed. The incident prompted system-wide password resets and legal interventions, highlighting the disruption caused by third-party vendor compromises. No state affiliations or criminal partnerships have been attributed to CyberNiggers in available reporting. Their continued operational status remains unverified beyond the June 2024 event.