Cinder likely continues Pink operations amid data-extortion label overlap
Threat Actor Meta
Summary
Hide ▲
Show ▼
Cinder was assessed as a likely rebrand or continuation of Pink, signaling ongoing identity shifts in the data-extortion ecosystem and complicating attribution across related leak-site operations. The assessment also sits alongside UNC6671 and PREY-0058-linked tradecraft, reinforcing that the activity cluster is better understood as an evolving affiliate network than a single fixed actor. That overlap matters because it points to continuity in infrastructure, victims, and monetization even as labels change.
Related Happenings
Breeze Comet Brazil-based e-crime cluster with alias overlap and payment-fraud monetization
Threat Actor Meta
H score27
First: 01.09.2026 20:19
Last: 01.09.2026 20:19
Sources 1
About this happening:
Researchers have profiled Breeze Comet as a Brazil-based e-crime group with overlapping aliases and a monetization model centered on fraudulent transfers. The cluster'...
Breeze Comet Brazil-based e-crime cluster with alias overlap and payment-fraud monetization
Threat Actor MetaAbout this happening: Researchers have profiled Breeze Comet as a Brazil-based e-crime group with overlapping aliases and a monetization model centered on fraudulent transfers. The cluster'...
UNC6671 diversifies extortion operations across multiple public brands
Threat Actor Meta
H score44
First: 06.08.2026 23:07
Last: 06.08.2026 23:07
Sources 1
About this happening:
UNC6671 has shifted to a multi-brand extortion model, widening its operating footprint across Redact, Pink, Helix, and Falcon and increasing the difficulty of tracking...
UNC6671 diversifies extortion operations across multiple public brands
Threat Actor MetaAbout this happening: UNC6671 has shifted to a multi-brand extortion model, widening its operating footprint across Redact, Pink, Helix, and Falcon and increasing the difficulty of tracking...
Pink new extortion brand within The Com
Threat Actor Meta
H score31
First: 08.07.2026 19:47
Last: 08.07.2026 19:47
Sources 1
How related:
It also said that the data extortion threat actor known as Cinder likely represents yet another rebrand or a possible continuation of Pink operations, citing overlaps between organizations listed on the Cinder leak site and those connected to Pink.
About this happening:
Pink is an extortion brand linked to UNC6671 and tied in reporting to Cinder as a likely rebrand or continuation of Pink operations. The activity combines IT hel...
Pink new extortion brand within The Com
Threat Actor MetaHow related: It also said that the data extortion threat actor known as Cinder likely represents yet another rebrand or a possible continuation of Pink operations, citing overlaps between organizations listed on the Cinder leak site and those connected to Pink.
About this happening: Pink is an extortion brand linked to UNC6671 and tied in reporting to Cinder as a likely rebrand or continuation of Pink operations. The activity combines IT hel...
Scattered Spider reclassified as a decentralized collective of independent clusters
Threat Actor Meta
H score26
First: 07.07.2026 17:00
Last: 07.07.2026 17:00
Sources 1
About this happening:
Scattered Spider has been reclassified as a decentralized cybercrime collective, changing how its persistence and resilience are understood. The shift suggests independe...
Scattered Spider reclassified as a decentralized collective of independent clusters
Threat Actor MetaAbout this happening: Scattered Spider has been reclassified as a decentralized cybercrime collective, changing how its persistence and resilience are understood. The shift suggests independe...
CL-CRI-1116 / BlackFile overlap with The Com
Threat Actor Meta
H score31
First: 27.04.2026 11:15
Last: 27.04.2026 11:15
Sources 1
About this happening:
Researchers linked CL-CRI-1116 to overlapping labels including BlackFile, UNC6671, and Cordial Spider, suggesting the extortion cluster sits inside a broader The...
CL-CRI-1116 / BlackFile overlap with The Com
Threat Actor MetaAbout this happening: Researchers linked CL-CRI-1116 to overlapping labels including BlackFile, UNC6671, and Cordial Spider, suggesting the extortion cluster sits inside a broader The...
Timeline
-
07.09.2026 18:51 2 articles · 1h ago
Cinder is assessed as a continuation of Pink operations
Attribution UpdateCinder is assessed as a likely rebrand or continuation of Pink, based on overlap between organizations listed on the Cinder leak site and organizations tied to Pink. The surrounding label set remains unsettled and does not map cleanly to a single proven actor identity.
Show sources
- Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks — thehackernews.com — 07.09.2026 18:51
- Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks — thehackernews.com — 07.09.2026 18:51