Threat Actor Zestix: How Stolen Cloud Data from ShareFile, Nextcloud, and OwnCloud Is Being Sold on the Dark Web

By Kim Njuki March 19, 2025 Updated: August 25, 2026 6 min read

A threat actor operating under the handle Zestix has emerged as a notable initial access broker in 2026, specializing in the collection and resale of corporate data harvested from cloud file-sharing environments. According to threat intelligence reporting from Hudson Rock and corroborating analysis from multiple cybersecurity research teams, Zestix has successfully compromised organizations across the aviation, defense, and healthcare sectors by leveraging infostealer malware — specifically variants of RedLine and its successors — to harvest employee credentials that provide entry points into corporate ShareFile, Nextcloud, and OwnCloud deployments.

The Zestix operation is a particularly clear illustration of how the initial access broker (IAB) ecosystem has matured in 2026. Rather than conducting full-scale ransomware deployments or data extortion campaigns, IABs like Zestix specialize in the acquisition and commodification of access — gathering stolen credentials, verifying that they still work, documenting what systems they can reach, and then selling that packaged access to other threat actors who handle the downstream exploitation. It's a division of labor model that has made the ransomware economy significantly more efficient and scalable.

How Zestix Acquires Access: The Infostealer Pipeline

The foundation of Zestix's operation is infostealer malware, a category of malicious software designed specifically to harvest credentials, session tokens, browser cookies, and other authentication artifacts from infected endpoints. RedLine Stealer has been one of the most widely deployed infostealers of the past several years, and while law enforcement actions have disrupted its original infrastructure, successor tools and forks continue to circulate on dark web markets.

The infostealer infection pathway typically begins with a malware distribution campaign — often disguised as a software crack, a game cheat tool, a pirated productivity application, or a malicious attachment delivered via phishing. When an employee installs or opens the infected file, the infostealer silently harvests stored credentials from browsers, password managers, and application credential stores before transmitting them to a collection server controlled by the attacker.

Critically, infostealers don't just grab usernames and passwords. Modern variants also harvest session cookies that may allow an attacker to bypass multi-factor authentication by hijacking an already-authenticated session. This means that even organizations that have deployed MFA across their workforce are not fully protected if employee endpoints are compromised by infostealer malware.

Why Cloud File-Sharing Platforms Are High-Value Targets

ShareFile, Nextcloud, and OwnCloud represent a specific class of target that IABs like Zestix find particularly valuable: platforms where organizations store sensitive operational documents in a format that's readily accessible once you have credentials. Unlike core business systems — ERP platforms, financial systems, HR databases — cloud file-sharing environments often accumulate files organically over years without rigorous access controls or data classification.

This means that a set of compromised ShareFile credentials might provide access not just to a few recent documents, but to years of accumulated sensitive material: contracts, proposals, financial models, personnel records, technical specifications, compliance documentation, and communications that executives assumed were safely stored in a trusted environment. For a threat actor, this is often more immediately valuable than access to a more tightly controlled core business system.

The sectors represented in Zestix's victim portfolio — aviation, defense, and healthcare — are particularly sensitive from a data value perspective. Aviation and defense organizations handle proprietary technical documentation, supply chain relationships, and in some cases export-controlled technical data. Healthcare organizations hold patient records that are valuable for identity theft and insurance fraud.

Hudson Rock's Analysis and What It Reveals About the IAB Market

Hudson Rock, which operates one of the more comprehensive infostealer credential monitoring services available to corporate customers, flagged the Zestix operation after observing patterns in credential listings on dark web forums that pointed to a systematic targeting of cloud file-sharing platforms. Their analysis suggests that Zestix is not a lone operator but rather a structured operation with the infrastructure to reliably process, verify, and list stolen access at scale.

This reflects a broader maturation of the IAB market. Early IAB operations were often opportunistic — attackers who found themselves with access they couldn't exploit directly and decided to sell it. Contemporary IAB operations like what Hudson Rock attributes to Zestix are more systematic: they have preferred target categories, established verification workflows, and a customer base in the cybercrime ecosystem that creates reliable demand for their product.

For enterprise security teams, the Hudson Rock intelligence matters because it highlights the importance of monitoring the dark web for leaked credentials belonging to your organization. Many organizations discover breaches only after the damage has been done. Services that provide early warning when employee credentials appear in infostealer logs or IAB listings can provide a critical window for defensive action before attackers escalate from initial access to data theft or ransomware deployment.

Protecting Your Organization From the Zestix Threat Vector

The infostealer-to-IAB pipeline that Zestix represents requires a multi-layered defensive response. At the endpoint level, robust endpoint detection and response (EDR) tooling can identify and block infostealer activity before credentials are exfiltrated. But given that infostealers often operate for hours or days before detection, this can't be the only line of defense.

At the identity layer, session token binding and device trust policies can reduce the effectiveness of cookie hijacking attacks that allow MFA bypass. Organizations that rely on cloud file-sharing platforms should audit which accounts have access to what data and implement least-privilege principles rigorously — the damage from any given credential compromise is limited by how much that credential can access.

At the intelligence layer, integrating dark web monitoring into your threat intelligence program provides the early warning capability that can convert a potential breach into a credential rotation exercise rather than a data loss incident. Hudson Rock's research demonstrates that compromised credentials often appear in infostealer logs well before they're used for corporate network access — which means organizations that monitor for their employees' credentials in stealer logs have a genuine opportunity to act before exploitation occurs.

Zestix may be one actor, but the pipeline they represent is a structural feature of 2026's threat landscape. Understanding it is the first step toward building defenses that can disrupt it.