Executive Summary  

Cinder is a new, financially motivated data-extortion operation whose first victim listings appeared on 20 August 2026. It has claimed 8 organisations, all in the United States, with roughly 12.3 TiB of stolen data claimed in total. The group presents itself as an "entity" that finds "security issues", tells victims to "resolve" them, and promises to "shred" the data on payment. This is a responsible-disclosure narrative wrapped around a standard pay-or-leak model. Nothing on its leak site or in public reporting mentions file encryption, a decryptor, or a ransomware family, so Cinder may be a data-theft-only actor.  

Its victims are established mid-to-large enterprises, concentrated in manufacturing and industrial supply chains, with additional listings in engineering services, financial services and commercial real estate. Victims are named in batches (three listings within about 45 seconds at launch), and the group's own countdown timers appear not to be strictly enforced. The most recent listing was 15 September 2026, so the group has been quiet for about two weeks.  

Public technical intelligence on the group is minimal. Its infrastructure is a single Tor site with no published contact channel, wallet or negotiation portal. Only one victim, Acima's parent company, has a related public disclosure, and that disclosure does not name Cinder. For defenders, the most useful lessons are credential and identity hygiene, monitoring for bulk data exfiltration rather than encryption behaviour, and a prepared response to a 30-day publication clock.  

Threat Profile  

Group Overview  

Cinder's leak site was first seen online on 21 August 2026, one day after its first listings. Trackers label the group by the start of its onion address (iah6477 or iah647), while the site itself is titled "cinder" with the tagline "unresolved mistakes kept here". There is no evidence of a rebrand or affiliation with an earlier group, no RaaS recruitment, no affiliate programme, and no data auction.  

The group's own pages state it is financially motivated, not political, and that data is "held anonymously" during negotiation. If terms are met, everything is "shredded" and nothing is published. If not, the data is posted on the site for 30 days and then moved to an external mirror that is "kept updated over time".  

Operational Characteristics  

Victimology  

Geographical Distribution  

All 8 victims are assessed as US-based. Trackers attribute 7 to the US and leave one (Marvin) blank, but that company is headquartered in Minnesota. Victim locations span Ohio, Minnesota, Illinois, Connecticut, Georgia, Florida and Texas (parent of Acima), so there is no single-state concentration.  

Sector Targeting  

Late-August snapshots showed "soon" countdowns of 7–9 days, and MAT was recorded as public with about 27 days remaining on 29 August, consistent with a 30-day hosting window. Working back from later snapshots, public hosting for the three expired victims ended around 19–28 September. Two early listings carried a download indicator (Acima at 2.1 TiB, Marvin marked "not available for download yet"). I could not find any independent analysis of published content or the location of the promised "external mirror".  

About page:  

Cinder describes itself as an entity that believes information is power and that a security issue is only dangerous when those able to fix it do not. The victim receives a note, adds the group, confirms the "issue" and negotiates "in good faith". If a deal is reached, data is shredded and nothing is published. If not, data is published anonymously for 30 days and then moved to an external mirror.  

Our Promise page:  

Messaging analysis. The tone mimics coordinated vulnerability disclosure: the intrusion is a "finding", payment is a "reward for effort", and the operator wants to appear reasonable and reliable. This reduces victim resistance and lends credibility to the assurances about deletion. Two phrases carry technical implications, though both are inferences. "Add us" suggests the ransom note carries a contact identifier for an external messenger, since the DLS has no chat portal. "Our access to your accounts and files" suggests the actor retains access to accounts (cloud, SaaS, identity or remote access) as well as file stores.  

Technical Analysis  

Initial access:  

Collection and exfiltration:  

 Claimed volumes of 148 GiB to 4.2 TiB imply bulk staging and transfer of file-server, document or cloud-storage content. The transfer method is unknown.  

MITRE ATT&CK TTPs  

Indicators of Compromise (IOCs)  

Leak site (Tor): iah6477wcvisc45wl54u524fbrh4dnmtcctpg2fpe5epf3jbpkiwu4qd[.]onion  

Conclusion  

Cinder is a small but deliberate operation. It targets established US firms, uses a disclosure-style narrative to legitimise extortion, and applies a 30-day publication clock. With only eight victims in its first 40 days and no observed enforcement of several deadlines, its true capability and consistency are unproven. Its tradecraft is largely unknown, its claims are unverified, and encryption is unconfirmed. Defenders should therefore prioritise identity security, exfiltration detection and prepared extortion-response playbooks rather than Cinder-specific signatures.