GTG-50020
GTG-50020 is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets the Defense and Aerospace sector. It uses 1 MITRE ATT&CK technique.
Also known as
- Russian-speaking, financially motivated
- Techniques
- 1
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
Sectors · 1
About GTG-50020.
A financially motivated actor who intruded into AI vendor environments to steal production API keys and employed KYC relay schemes using lookalike verification domains to capture verified sessions. They targeted approximately thirty AI companies.
Last updated Sep 15, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.