Icarus — Ransomware Profile
Icarus is a ransomware and data-extortion actor tracked by IntelFusions. It has been linked to victim listings published on data-leak sites during 2026.IntelFusions coverage (1)
- Icarus extortion crew breaches Klue and steals customer Salesforce data 2026-06-22 · Cyber Incidents
Recent claimed victims
- Huntress 2026-06-22
- HDS (Hdscorp) 2026-06-22
- Gms-net 2026-06-22
- Cqcrm 2026-06-22
- Cbassociations 2026-06-22
- DEADLINE MONDAY 2026-06-20
- Klue.com 2026-06-19
- thecreditpros.com 2026-06-16
- Cazh.id 2026-05-05
Vendor research
- Cybercrime Breaches Klue: Salesforce Data Impacted for Many Victims, including Huntress Huntress
- Technical Analysis of the Klue Attack: OAuth Abuse, Stale Integrations, and Salesforce Exfiltration Obsidian Security
- Detecting the Klue supply chain attack in Salesforce instances Datadog Security Labs
- ZeroFox Intelligence Profile – ICARUS ZeroFox