Rey
Attribution profile
- Type
- Criminal
- Location
- Romania
- Known incidents
- 3 incidents
- Sources
- 0 sources
- First seen
- 2025-01-01
- Last seen
- 2025-11-01
- Updated
- 2026-10-03 02:10
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Rey is a hacker operating from Romania who uses the alias Rey and has claimed affiliation with the HellCat ransomware group. The actor has repeatedly targeted the Romanian telecommunications provider Orange România, exploiting compromised credentials and vulnerabilities in the company’s Jira issue‑tracking system to gain initial access. After maintaining undetected presence for over a month, Rey exfiltrated data during a short three‑hour window, taking approximately 380 000 unique email addresses, internal documents, source code, invoices, contracts and partial payment‑card details, including information from the Yoxo subscription service. A ransom note was left on the compromised systems, indicating a financially motivated extortion attempt, though the victim did not pay and the stolen data was later published on a hacker forum. No state linkage or additional malware families are described in the open sources.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 0 sources.