Skip to content
CybercrimeFinancial

Roxanne

Roxanne is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets organisations in Israel.

Techniques
0
Exploited CVEs
No CVE data
First seen
Jun 11, 2026
Last seen
Sep 26, 2026
Record updated

Who They Target.

Countries · 1
Labelsaccess-salecybercrimedark-web-forumextortion-claimfortinet-accessinitial-access-brokerstolen-datatelegram

About Roxanne.

Roxanne is a financially motivated cybercriminal persona active on an underground forum. The persona advertises unauthorized access to corporate networks and email accounts, purportedly stolen organizational data, and access associated with Fortinet-protected environments. Observed listings span education, retail, manufacturing, directory services, and human-resources-related targets across multiple countries. The available evidence consists of self-published forum listings and attached screenshots. The claimed compromises, data volumes, encryption activity, and victim impact have not been independently corroborated. Although the existing entity is typed as a group, the supplied material does not establish the number of operators or a formal group structure.

Last updated Oct 5, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.