// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE PUB-ENTDTG 0600Z
ColdRecon › Threat Groups › TheHatman
Threat Group Dossier

TheHatman

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
TheHatman — 5 attributed incidents across our corpus.
Incidents on file5
First seen2026-08-18
Last seen2026-08-22
Top sector—

Techniques observed (MITRE ATT&CK)

T1078 Valid Accounts (5)

Attributed breaches

2026-08-22
stolen creds
McDonald's, Vodafone, Kyndryl & Others
2026-08-21
stolen creds
McDonald's, Vodafone, Kyndryl & Others
2026-08-20
stolen creds
McDonald's, Vodafone, Kyndryl & Others
2026-08-19
stolen creds
McDonald's, Vodafone, Kyndryl & Others
2026-08-18
stolen creds
McDonald's, Vodafone, Kyndryl & Others

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →