Sorb
Sorb is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 7 sectors, including Government and Finance, in 3 countries, including Vietnam and Pakistan. It uses 6 MITRE ATT&CK techniques.
- Techniques
- 6
- Exploited CVEs
- No CVE data
- First seen
- Jun 14, 2023
- Last seen
- Oct 12, 2026
- Record updated
Who They Target.
About Sorb.
Sorb is a financially motivated individual threat actor active on BreachForums since June 2023, holding the “GOD” rank with 84 threads. The actor operates as a data broker and has listed dozens of databases allegedly stolen from small and mid-sized organizations worldwide. These include government portals, financial services, healthcare, e-commerce and technology firms, with heavy focus on India, the USA, Latin America and Southeast Asia. Sorb occasionally releases datasets for free to build reputation, and promotes a full data list through a Telegram channel and an X account. Many claims are unverified.
Last updated Oct 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.