Also known as: tracked as, Lou Gehrig's disease, Wall Street, was an American businessman
Known victims: 5
Objectives
Targeted Sectors
Targeted Countries / Regions
Executive Summary
The threat actor known as 'wallstreet' is a medium-sophistication criminal group primarily motivated by financial gain through ransomware activities. Operating since June 2026, they have targeted sectors including automotive and healthcare, with notable campaigns such as the attack on Gold Standard Automotive. Their modus operandi involves strategic targeting of industries likely to yield high monetary returns, leveraging ransomware and data exfiltration for organizational profit.
Goals & Targeting
Wallstreet targets sectors such as automotive and healthcare due to their vulnerability and high potential for financial gain through ransomware. They likely focus on industries where data breaches can lead to substantial ransoms or data sales, such as those with sensitive customer information. Their campaigns suggest a preference for North American entities, possibly due to easier access vectors like RDP vulnerabilities or phishing.
Enhanced Description
Wallstreet is a cybercriminal group specializing in ransomware operations, primarily targeting sectors with financial value and sensitive data. Linked campaigns include attacks on automotive dealerships, healthcare organizations, and local government entities, indicating a strategic focus on industries where data breaches can yield significant financial returns. The group's activities demonstrate a methodical approach to compromising networks, encrypting data, and demanding ransoms for decryption keys. Wallstreet operates with medium sophistication, relying on established tools and techniques but not yet evidence of advanced persistence or complex campaign infrastructure.
Key Capabilities
MITRE ATT&CK Tactics
ATT&CK Techniques
Software / Tooling
Campaigns & Victims
Wallstreet has conducted several campaigns targeting various industries. Notable victims include Gold Standard Automotive, Baraga County Memorial Hospital, Edgewood Police Department, and Omax Autos. Their attacks involve initial access via RDP or phishing, followed by data encryption with ransomware demands. Campaigns exhibit a modus operandi of compromising systems, encrypting files, and leaving instructions for payment in clear text.
IOC Patterns
Recommended Actions
Suggested Tags
Confidence Assessment
Confidence is moderate based on linked campaigns and TTP analysis, but gaps exist in detailed attack patterns and specific toolsets used.
No observed data linked yet.
40
Techniques
44
Tools
7
Campaigns
40
IOCs
0
Observed Data
9
Tactics