Threat Actor Profile

Outrider Tiger

Outrider Tiger is a financially motivated cyber threat actor, first identified in June 2023. Known for its development and operation of the Nitrogen loader and LukaLocker ransomware, Outrider Tiger initially operated as an affiliate of the Alphv Ransomware-as-a-Service (RaaS) program until its closure in March 2024.

Threat Actor Profile

Outrider Tiger

Country of Origin

Outrider Tiger is linked to India, with evidence suggesting state-sponsored motivations tied to intelligence collection.

Members

The exact size of Outrider Tiger is unknown. It is believed to consist of a small, specialized team with expertise in malware development and ransomware deployment.

Leadership

The leadership of Outrider Tiger remains unknown. However, their operations suggest a highly organized structure with access to advanced tools and resources.

Outrider Tiger TTPs

Tactics

The group primarily focuses on credential harvesting and targeted intrusions to support intelligence collection.

Techniques

Outrider Tiger employs adversary emulation frameworks like Sliver, Cobalt Strike, and Havoc, alongside custom malware families such as WarHawk and RedThreat.

Procedures

Their methods include phishing campaigns, exploitation of vulnerabilities, and deployment of custom malware to infiltrate and exfiltrate sensitive data.