MARLBORO Group

MARLBORO Group, also observed under the labels DEVIL MARLBORO, MARLBORO, группировки MARLBORO, and ПЕРЕХОДНИК НА МАЛЬБОРО, is an emerging Russian-language actor or sales identity monitored through Telegram account @[redacted]. Internal collection indicates that the channel was created on 2026-05-12.

The actor presents itself as a broker of sensitive datasets and intelligence-style packages. Observed offers include alleged records associated with employees of the Russian Federal Protective Service, alleged records associated with Security Service of Ukraine personnel, and an extraordinarily broad package allegedly linked to North Korea, Kimsuky and Lazarus Group. The latter package is marketed as containing source code, zero-day vulnerabilities, offensive tools, certificates, cryptocurrency-wallet records, identifying information on operators and information linked to sensitive North Korean facilities.

MARLBORO Group also published a teaser claiming that it would announce access to hijacked software allegedly used to track air-defense, missile-defense, unmanned-aerial-vehicle and drone activity. No technical evidence has been identified that validates this claim.

INFERENCE (confidence: medium-high): MARLBORO Group is attempting to establish itself rapidly as a clandestine intelligence and data-brokerage brand rather than as a conventional intrusion crew. Its commercial positioning relies on the perceived sensitivity of the advertised material, bilingual promotional posts, image-based previews and low-friction Telegram contact.

INFERENCE (confidence: medium): The breadth of the advertised North Korea-linked package and the comparatively low requested price require caution. Plausible explanations include a mixture of authentic material, recycled datasets, open-source compilation, limited samples, exaggerated framing or fraudulent sales behavior.