Andrew
Named by 2 kept items in this workspace.
1 items name it under classification.key entities and 1 under threat actors.
Search every workspace for Andrew. It matches the name as written, so it can find other things that share it.
The items that name it 2
Individual threat actor (not claiming ties to any established ransomware or extortion gang) who allegedly used stolen customer credentials to access an Oracle Health legacy Cerner server after January 22, 2025, copied data to a remote server, and demanded millions of dollars in cryptocurrency, setti
All threat actors in this workspace.