NoxShell Cloud Systems • Premium VPS & Shell Satış
NoxShell Cloud Systems • Premium VPS & Shell Satış is a threat actor group with an ideological motive, tracked by Brandefense. It targets 4 sectors, including Technology and Finance. It uses 5 MITRE ATT&CK techniques.
- Techniques
- 5
- Exploited CVEs
- No CVE data
- First seen
- Nov 22, 2025
- Last seen
- Sep 19, 2026
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
5 techniques across 4 of 14 tacticsAbout NoxShell Cloud Systems • Premium VPS & Shell Satış.
NoxShell Cloud Systems • Premium VPS & Shell Satış (user_id ) is a financially-motivated Telegram threat actor tracked through the Brandefense dark-web collection. Between 2025-11-22 and 2026-09-19 the channel posted 90 messages across 1 channel, and is assessed at HIGH (score 7). Its activity centres on phishing / fake pages, malware / checker tooling, operational coordination and unclassified. Observed methods: harvest credentials via phishing; distribute malware and checker tooling. 8 indicators were extracted from these messages, which were posted mainly in NoxShell Cloud Systems • Premium VPS & Shell Satış. It posts in TR, placing its assessed origin in Turkey. Its targeting falls on the Technology, Telecommunications, Internet & Direct Marketing Retail, Retail-And-Commerce, Software & IT Services and Finance sector and victims in Turkey. 4 targeted organisations are recorded as restricted relationships rather than named here. Identity is a Telegram channel brand: posts are published under the channel's own name and the operator(s) behind it are not resolved.
Last updated Oct 7, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.