Researchers Reveal Connection Between Belsen and ZeroSeven Cybercrime Groups

According to KELA, the analysis points to a potential connection between two Yemen-linked threat actors: the newly surfaced Belsen Group and the longer‑standing ZeroSevenGroup. The Belsen Group first appeared in January 2025 on BreachForums, announcing the leak of 1.6 GB of data harvested from over 15,000 vulnerable FortiGate firewalls, obtained by exploiting the CVE-2022-406841 authentication bypass flaw.

The group established multiple communication channels and mirrored victim listings across BreachForums, Twitter and an onion site, while offering network access to victims across Africa, North America and Asia. ZeroSevenGroup has been active since July 2024, leaking stolen databases and network access for targets in several countries, and monetising larger datasets by late 2024.

KELA identified several overlaps, including identical post-title formats and near-verbatim wording in announcements, overlapping geographic indicators such as Yemen, and shared patterns in branding by using “Group” in their handles. While not conclusive, the evidence suggests at least some degree of affiliation or shared resources between the two actors, underscoring the need for monitoring potential coordinated campaigns.