The Belsen Group surfaced in January 2025, leaking Fortinet data and selling network access, while ZeroSevenGroup had been active earlier, breaching companies and monetizing stolen data.

IntelBroker entered the scene in late 2022, first appearing on BreachForums and rapidly building a reputation as a ransomware operator at first and then as an actor responsible for many high-profile data breaches.