SnowSoul
No sourced public emblem in this profile.
reference profile · reported nexus: Unknown (not nationality)
SnowSoul is a financially motivated threat actor active since at least early 2026, operating a low-ransom extortion scheme primarily targeting Chinese organizations. The actor sends extortion demands of around $2,000 USD, and when victims refuse to pay, leaks stolen data on hacker forums. Operations are tracked through numbered identifiers (e.g., SnowSoul ID-1265, ID-1270), suggesting a systematic, serial campaign.
Source-reported aliases: . Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://dailydarkweb.net/snowsoul-attack-hits-multiple-chinese-organizations/
https://dailydarkweb.net/guangdong-caiding-market-group-faces-data-breach-after-extortion/
https://hacknotice.com/2026/03/16/hualun-new-materials-suffers-massive-data-breach-by-snowsoul/