Sharp Boys

Profile narrative

Sharp Boys is a threat actor identified by the alias Sharp Boys and has been associated with operations originating from Russia. The group came to public attention after claiming responsibility for a breach of two Israeli hiking websites in December 2021, where they accessed and subsequently leaked personal information belonging to approximately one hundred thousand users. In addition to the data leak, Sharp Boys offered for sale a larger dataset purportedly containing details of around three million individuals, indicating a financial motive tied to the monetization of stolen information. The compromised data included email addresses, physical addresses, phone numbers, and photographs, which the attackers made publicly available on the internet. Their targeting appears focused on online platforms that provide recreational services, specifically those catering to hikers in Israel, suggesting a regional interest in Israeli‑based digital assets. No further details about the sectors they typically pursue beyond this incident are documented in the available sources.

The observed tactics involve gaining unauthorized access to web applications, extracting stored user data, and then disseminating that data through public leaks and underground sales channels. No specific malware families, exploit kits, or distinctive tooling have been reported in connection with Sharp Boys’ activities, so the described behavior remains limited to web‑site intrusion and data exfiltration. Attribution to a Russian location is based on the geographic information supplied in the threat actor context, but no explicit links to state sponsorship or criminal syndicates have been established in public reporting. The December 2021 operation against the Israeli hiking sites Tiyuli and Lametayel stands as the sole publicly documented campaign attributed to the group, representing their known activity to date. No additional incidents, tools, or affiliations are referenced in the supplied material, and therefore the profile is confined to these confirmed facts.

Incidents

Attributed incidents are available to members.