Cybercrime
SnowSoul
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
SnowSoul is a financially motivated threat actor active since at least early 2026, operating a low-ransom extortion scheme primarily targeting Chinese organizations. The actor sends extortion demands of around $2,000 USD, and when victims refuse to pay, leaks stolen data on hacker forums. Operations are tracked through numbered identifiers (e.g., SnowSoul ID-1265, ID-1270), suggesting a systematic, serial campaign.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
No posts or advisories have named this actor recently.
References
- https://dailydarkweb.net/snowsoul-attack-hits-multiple-chinese-organizations/
- https://dailydarkweb.net/guangdong-caiding-market-group-faces-data-breach-after-extortion/
- https://hacknotice.com/2026/03/16/hualun-new-materials-suffers-massive-data-breach-by-snowsoul/
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.