Cybercrime high Unknown

FulcrumSec

Cybercrime — pure data extortion · Financial — data theft and extortion without ransomware encryption

Reports 1

Active Since At least late 2025 (October 2025 per earlier Adversary Wire reporting; the group's Arup claim implies access from September 2025)

Last Reported 17 Jun 2026

Sectors Targeted technology, pharmaceutical, manufacturing, healthcare

Tactics, Techniques & Procedures (TTPs)

Entry via secrets exposed in client-side JavaScript on forgotten subdomains. Sources disagree on the secret type: the group claims a GitHub token; CybelAngel says production credentials in frontend JavaScript. "PAT scanning" as an automated technique is not sourced
Cloning of private repositories to reach source code, CI/CD configuration and credentials (per the group's claims)
Use of harvested credentials to reach cloud data (per the group's claims, e.g. AWS keys in the Arup claim)
Pure extortion without encryption; after a $25M demand was refused the group said it was exploring private sales (Reuters via Yahoo)
Leaks published via Hugging Face (Paubox, low-medium confidence)

Known Targets

Avnet (listed February 2026; leak size reported inconsistently)youX (April 2026, 300GB claimed)Novo Nordisk (June 2026): disclosed 11 June 2026; the company said non-public data was copied, including clinical-trial data without direct identifiers. $25M demand reported. A "Stage 2" leak of AI models and datasets (about 1.05 TB claimed) is the group's own claimArup Group (listed 10 May 2026): group claims access since September 2025 and 10,000+ private repositories (claim only; BushidoToken search snippet)

Analyst Notes

FulcrumSec is a data-extortion group with no ransomware component. Most details come from the group's own claims and secondary summaries. The October 2025 start date originates in earlier Adversary Wire coverage and is cited back by Paubox, so it is not independent. Avnet and Novo Nordisk are both reported at 1.3 TB in different sources and may be conflated; treat sizes as unverified. No ATT&CK mappings are sourced; those listed are the site's own. Nothing newer than June 2026 was found.

MITRE ATT&CK Techniques

T1552.001 Unsecured Credentials: Credentials in Files (GitHub PAT scanning) T1213 Data from Information Repositories (private repo cloning) T1530 Data from Cloud Storage (victim credential reuse) T1657 Financial Theft / Extortion T1078.004 Valid Accounts: Cloud Accounts

Intelligence Reports

Analysis technologypharmaceutical

FulcrumSec: Deep Dive into the Data Extortion Group Exploiting Developer Credential Sprawl

FulcrumSec emerged in October 2025 running pure data extortion with no ransomware component. Confirmed victims include Avnet (1.3TB), youX (300GB), and Novo Nordisk (1.3TB, $25M demand). Their initial access technique — GitHub PATs exposed in client-side JavaScript — is simple, scalable, and rapidly becoming a template for other extortion groups. This deep dive covers their attack chain, operational history, tooling characteristics, and defensive countermeasures.

17 Jun 2026 · 11 min read