RobinHood

victims

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.robinhood

Threat Analysis

RobinHood is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Ransomware Victims (1)

CTIWATCH tracks 1 organizations claimed as victims by RobinHood on its data leak site, with attack dates, sectors and countries.

View full victims list →

Intelligence Reports Mentioning RobinHood

Robinhood Cuts Access Approval Time to Support High-Velocity Development

Dark Reading· Jun 25, 2026

Robinhood Vulnerability Exploited for Phishing Attacks

SecurityWeek· Apr 28, 2026

Robinhood account creation flaw abused to send phishing emails

BleepingComputer· Apr 27, 2026

External References

→https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf

→https://arstechnica.com/information-technology/2019/05/baltimore-city-government-hit-by-robbinhood-ransomware/

→https://blogs.quickheal.com/a-new-ransomware-goodwill-hacks-the-victims-for-charity-read-more-to-know-more-about-this-ransomware-and-how-it-affects-its-victims/

→https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf

→https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf

→https://goggleheadedhacker.com/blog/post/12

→https://krebsonsecurity.com/2019/06/report-no-eternal-blue-exploit-found-in-baltimore-city-ransomware/

→https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/

→https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/

→https://statescoop.com/baltimore-ransomware-crowdstrike-extortion/

Quick Facts

TypeAPT / Threat Group

Aliases4

Also Known As

HelpYemenwin.robinhoodRobinHoodRobbinHood

External Intelligence

Malpedia: win.robinhood

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·RobinHood Victims (1)·Geopolitics Map·Search RobinHood