Monitoring deep, dark and surface web to detect exposure of your sensitive data, secret projects and initiatives, privileged users, critical systems, IT infrastructure, and more.
Monitoring and alerting of third party data breaches impacting your employees’ emails, usernames, and personally identifiable information.
Assess the risk footprint and security posture of key business relationships to get a handle on external risk introduced through your extended attack surface.

Sign Up for Updates
Digital risk monitoring of key personnel with telemetry and risk metrics. VIPRecon provides broad coverage of social media, deep and dark web, as well as physical threat assessments.
Our Ransomware Response Readiness Assessment, Playbook and Table Top Exercise gives your organization the best chance to survive and recover.
Gain visibility of your digital footprint by reaching into the most active areas of the cyber underground.
Fully managed and tailored Threat Intelligence services that becomes an extension of your current security processes and provides real-time visibility on new threats.
Providing research and investigations into known threats, to save security teams time and stress during a cyber emergency.

Sign Up for Updates
GroupSense offers a comprehensive package of services for assessing and responding to ransomware attacks, including negotiations with threat actors.
Actively researching and monitoring threats from vendors or third-party companies that can affect organizational security.
Monitoring for threats to elections, VIPs, and more on social media to proactively prevent or mitigate digital risk.
Focusing on the threats and risks that matter to your security processes and providing intelligence and insights to prevent or mitigate digital risk.
Taking the next step in security services, by proactively taking down phishing sites or anonymously interacting with threat actors to provide better intelligence.
Active monitoring of your brand's digital assets to protect its reputation and stop further brand abuse from targeting unsuspecting victims.

Sign Up for Updates
Combining your cyber and fraud programs to effectively fight threat actors continually scamming or threatening assets within an organization.
Executives are prime targets for fraudulent activities, but with a proactive approach, any attacks or threats can be neutralized before causing any damage.
Governments, political parties and candidates must all act now to activate cyber threat intelligence services to harden their information security and get ahead of inevitable cyber threats to the election process.
security-intelligence-feeds

Your intellectual property could be on the dark web. Now what?

GroupSense can recover your data and intellectual property from threat actors. Learn how below.

Fortify My Data

Your Data is Lucrative for Cyber Criminals

Reduce Fraud & Reputational Damage with Dark Web Data Recovery

During routine monitoring, GroupSense analysts found our client SynthoMedica's intellectual property on the dark web. By leveraging GroupSense's 1,000+ undercover personas, we recovered confidential data, reducing fraud, counterfeit drug risk, and reputational damage.

 

insider-threat

GroupSense pinpointed the intellectual property leak in our client's organization, reducing future insider threat.
cybersecurity

The team strengthened SynthoMedica's fraud defense after removing protected data from the dark web.
profit

GroupSense secured SynthoMedica's reputation by removing leaked data, protecting against loss of brand trust.

Case Study: Dark Web Data Recovery

Follow along to see how we recover data through threat actor engagement.

Jump to:
SynthoMedica's dedicated analyst NotGroupSense was monitoring Telegram channels when the threat actor Oppenh3imer reached out with a private offer. NotGroupSense engaged the actor to get more information when they realized Oppenh3imer's offer was confidential intellectual property. NotGroupSense notified the client with an advisory in the portal.

SynthoMedica Profile

 

Dramatized chat logs between GroupSense and the threat actor, known as Oppenh3imer.

As a Digital Risk Protection Services client, SynthoMedica receives an advisory for any relevant threat intelligence. GroupSense analysts perform threat analysis, threat actor attribution, and provide recommended next steps.

 

Urgent Advisory: Threat Actor Attempts to Sell SynthoMedica's Intellectual Property

Executive Summary

Our cyber intelligence team recently engaged with a threat actor who claimed to possess highly sensitive information regarding the intellectual property of SynthoMedica Pharmaceuticals. The threat actor offered access to confidential drug formulas for a substantial price, implying they had potential buyers from other parties. The information provided was a snippet of the formula for one of SynthoMedica's latest medications, which appeared to be genuine but requires further verification.

Incident Overview

Our undercover cyber analyst initiated contact with the threat actor on 20 July 2023 after receiving information about the potential leak of SynthoMedica's intellectual property. The threat actor claimed to have obtained access to the confidential formulas of SynthoMedica's medications.

Conversation with the Threat Actor

The threat actor was cautious and demanded payment in exchange for sharing evidence of the stolen data. They showcased a snippet of the formula for one of SynthoMedica's prominent medications as proof of their claim. The threat actor asserted that other interested parties were in the picture, and they were prepared to negotiate with the highest bidder. While the authenticity of the provided snippet appears plausible, we recommend further validation before proceeding.

Intelligence on the Threat Actor

The threat actor demonstrated an astute understanding of the value of intellectual property and its potential worth on the black market. Their willingness to capitalize on sensitive pharmaceutical information suggests a level of sophistication, indicating they might be part of a well-organized cybercrime group or nation-state-sponsored hacking operation.

The actor did mention that they wanted to exchange the IP in person. Upon further investigation, it appears that the actor lives close to one of SynthoMedica’s manufacturing plants in Latvia. This indicates that the actor is an employee. The threat actor displayed a certain level of overconfidence in their ability to keep information exclusive to the highest bidder, raising questions about their reliability and trustworthiness.

Conclusion

The threat actor's claim of possessing SynthoMedica's intellectual property requires thorough verification. While the provided evidence suggests potential legitimacy, caution must be exercised when dealing with such sensitive information. SynthoMedica Pharmaceuticals should take immediate action to strengthen its cybersecurity posture and consider engaging law enforcement to handle this matter further.

Our cyber intelligence team will continue monitoring the situation and work diligently to ensure our client's assets remain secure from any potential cyber threats.

After receiving the advisory, SynthoMedica responds to GroupSense.

 

SynthoMedica: We want to pursue this. Can you engage with the actor and arrange to purchase and pick up the IP? We will verify the authenticity after receiving it.
 
GroupSense: Understood. We will reengage and plan an exchange.

Dramatized chat logs between GroupSense and the threat actor.

GS Banner 011

I'm ready to see how Digital Risk Protection can enable my organization to focus faster.

Strengthen My Data Against Threats

Reduce Your Risk

 

Knowing what your organization is up against is half the battle. In our latest report, Cybersecurity Threats to the Pharmaceutical Industry, we review the top threats facing the industry and recommended mitigation strategies. Download the report to:

  • Understand how to reduce insider threats
  • Receive top mitigation strategies
  • Gain an in-depth understanding of the impact of leaked data on the dark web
Get My Copy

Pharma Report Cover