Great at Theft, Bad at Branding

# Great at Theft, Bad at Branding Listen up. If you’re looking for a spooky name to put in your slide deck this week, you’re going to be disappointed. The most active actor on the wire right now is listed as "Unknown." I know that makes the analysts in the SOC twitchy. They want a brand. They want a fancy handle like "Lazarus" or some Norse mythology nonsense so they can pretend they're fighting a digital war instead of cleaning up a mess. But looking at the hits this week, "Unknown" isn't a ghost. It’s just the collective noise of every opportunistic criminal who realized that most companies are still running their crown jewels on a prayer and a leaked password. Look at the numbers. CareCloud just leaked just under 3.7 million records. SFR lost north of 2.1 million customer accounts. RingCentral saw 1.6 million account records walk out the door, and Baylor Genetics had over 248,000 Texans' medical and financial data exposed. That is a staggering amount of data to lose in a single week. When you see millions of rows moving, the instinct for some of you is to start using the word "sophisticated." Stop it. Usually, when I see a breach of that scale, it isn't because some genius wrote a custom zero-day. It’s because someone left an S3 bucket open or failed to rotate a key from three years ago. You don't need sophistication to steal 3.7 million records if the door is already unlocked and the data is sitting in one giant, unencrypted table. It’s not surgery; it’s a smash-and-grab. I remember when NotPetya hit. That was chaos for the sake of chaos—industrial-scale destruction that didn't care about the payout. Today's "Unknown" crowd is different. They aren't trying to burn the house down; they're just stealing everything that isn't bolted to the floor because it's high-margin and low-effort. The playbook here is simple: find a point of entry—likely an edge device or a compromised credential—and then move straight for the biggest table in the database. They don't linger. They don't play games with the IT staff. They just exfiltrate the bulk data and move on to the next target. Now, you’ll hear some people argue that you can't hit a company like RingCentral or SFR without some level of advanced persistence. They'll tell you these targets have "mature" security postures. That is a lie told by people who sell tools. A "mature" posture doesn't mean anything if your blast radius is infinite. The problem isn't how they got in; it's why one compromised account had the permissions to vacuum up 1.6 million records without triggering a single alarm. If you can move that much data without anyone noticing until the leak site post goes live, your monitoring is decorative. The real danger here isn't the attacker—it's the second-order effect. We talk about "victim organizations," but CareCloud and SFR aren't the ones who are going to feel this in five years. The people whose Social Security numbers and medical histories are now sitting on a forum for three cents a pop are the real victims. Once that data is out, it’s out forever. You can rotate a password, but you can't rotate your medical history or your SSN. We're creating a permanent class of vulnerable people because some admin forgot to check a box on an API gateway. Compare this to the named gangs. Medusa is making noise about hitting 500 critical infrastructure orgs. That’s loud. It’s designed to scare you into paying. But these "Unknown" actors? They are the ones actually draining the ocean. They don't need a brand because they aren't looking for fame; they're looking for liquidity. What would this cost you on a Tuesday? If you woke up tomorrow and found out 2 million of your customers' records were on a leak site, could you even tell me where those records are stored? Could you tell me who has access to them right now? If the answer is "I think they're in the cloud," you've already lost. Watch the brokers. The people selling the initial access are the ones driving this trend. When access to a mid-sized healthcare provider becomes a commodity item on a forum, these "Unknown" hits will only accelerate. I’ll believe it’s a state actor when they start deleting the data instead of selling it. Until then, assume it's just a guy in a hoodie who found your password in a dump from 2024.