Sheriff

Profile narrative

Sheriff is a cybercriminal group known by that alias, headquartered in the United States of America. On July 6, 2020, Sheriff advertised the sale of approximately 62,000 compromised eToro trading platform accounts. The offered accounts included login credentials, personal information, and associated account balances. This activity highlighted the group's focus on monetizing stolen financial‑sector data through underground markets.

Sheriff specializes in attacks against the financial sector, employing brute‑force techniques and credential‑stealing malware to gain initial access. The group has successfully breached a range of organizations, including investment funds, cybersecurity firms, universities, and transportation companies. A predominant vector used by Sheriff is the exploitation of vulnerabilities in Citrix remote desktop servers. This exploitation pattern aligns with the operational methods observed in the REvil ransomware group. Sheriff has been documented collaborating with REvil to facilitate corporate network intrusions and to monetize access via ransomware attacks. Such coordination reflects Sheriff’s integration within broader high‑profile cybercriminal ecosystems. Interactions between Sheriff and REvil operatives indicate joint efforts to sell stolen data and deploy ransomware for profit. Collectively, these actions demonstrate Sheriff’s role as a specialized actor in credential theft and ransomware‑enabled extortion.

Incidents

1 incident linked to this organisation.