Executive Summary
Since late 2025, a financially motivated threat group identified as JINX-0163 (operating under the name FulcrumSec) has targeted major organizations across the healthcare, technology, and business services sectors. The group follows a 'steal and squeeze' model, focusing on data exfiltration rather than encryption to extort victims. Notable breaches include a massive data theft from pharmaceutical giant Novo Nordisk and legal information provider LexisNexis.
Technically, FulcrumSec exploits poor identity hygiene—such as hardcoded GitHub tokens and unrotated JWT secrets—and public-facing vulnerabilities like CVE-2025-55182 (React2Shell). Once inside, they exploit over-permissioned IAM roles and container task roles to move laterally across AWS, Azure, and GitHub environments. The group is known for extended dwell times, often remaining undetected for months while methodically accumulating terabytes of sensitive intellectual property and employee records.
The group's success underscores a critical shift toward cloud-focused extortion. Their ability to monetize stolen cloud data without the need for ransomware payloads highlights systemic weaknesses in machine identity management and the rapid exploitation of web-based vulnerabilities. Organizations must prioritize the elimination of secrets from code and the enforcement of least-privilege cloud permissions to mitigate this threat.