New Technical Markers Reveal Expanding ShadowSyndicate Cybercriminal Infrastructure

Group-IB expanded the mapping of the ShadowSyndicate cybercrime cluster after identifying additional OpenSSH fingerprints and reused access keys that link dozens of servers. The infrastructure hosts C2 servers for commercial and open-source offensive tools and shows ties to affiliates of major ransomware gangs (Cl0p, ALPHV/BlackCat, Black Basta, Ryuk, Malsmoke). Analysts observed servers being transferred between internal clusters while retaining overlapping SSH keys—an operational habit that enables attribution. Group-IB recommends ingesting IoCs into TIPs and monitoring linked autonomous systems, suspicious credential logins, repeated MFA failures, and anomalous 2FA prompts.