FIN11

A financially motivated group tracked by Mandiant that conducted high-volume phishing from at least 2016 and later focused on large-scale data theft and CLOP ransomware extortion. It is known for exploiting file-transfer products and monetizing stolen information through public leak threats.