Groove emerged in mid-2021 as a self-proclaimed ransomware group, but its alleged operator, known as "Boriselcin," later claimed it was largely a social engineering experiment designed to manipulate media and security researchers. Presenting itself as a financially motivated entity engaged in industrial espionage, Groove encouraged a loose collective of cybercriminals and was closely linked to the Russian-language RAMP underground forum. Its activities included leaking Fortinet VPN credentials and publicly calling for cyberattacks against U.S. government interests, while advising against targeting Chinese entities. Although some researchers expressed skepticism about the "hoax" claim, noting the fluidity of cybercrime groups, Groove's operational activity remained minimal and short-lived, largely ceasing by early 2022.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker