@cloakXkeyboard
Attribution profile
- Type
- Criminal
- Location
- United States of America
- Known incidents
- 1 incident
- Sources
- 0 sources
- First seen
- 2020-04-11
- Last seen
- 2020-04-11
- Updated
- 2026-10-17 01:40
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor known by the alias @cloakXkeyboard, operating from the United States, was observed in April 2020 selling personal data of approximately 1.41 million US physicians obtained from an online healthcare professional directory. The compromised data included full names, gender, hospital affiliation, practice address, phone number and medical license numbers, but excluded email addresses and medical records. The actor’s activity targeted the healthcare sector within the United States, with a financially motivated objective of monetizing the stolen information, which could enable subsequent smishing, disinformation, phishing or ransomware campaigns against medical professionals during the COVID‑19 pandemic. No malware families, initial‑access vectors or tooling styles are described in the source material, and no state or criminal‑group affiliations are publicly attributed to this actor. The 2020‑04‑11 data‑sale incident represents the only publicly reported operation linked to @cloakXkeyboard.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 0 sources.