UnclassifiedUnknown
SnowSoul
SnowSoul is a threat actor group, tracked by Brandefense. It targets organisations in China. It uses 4 MITRE ATT&CK techniques.
- Techniques
- 4
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
Countries · 1
About SnowSoul.
SnowSoul is a financially motivated threat actor active since at least early 2026, operating a low-ransom extortion scheme primarily targeting Chinese organizations. The actor sends extortion demands of around $2,000 USD, and when victims refuse to pay, leaks stolen data on hacker forums. Operations are tracked through numbered identifiers (e.g., SnowSoul ID-1265, ID-1270), suggesting a systematic, serial campaign.
Last updated Sep 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.