Zestix Threat Actor Profile | TTPs, Victims, and Breach Activity

Introduction

Zestix is identified as a criminal threat actor primarily motivated by personal gain. The actor first emerged in September 2025 and operates at an intermediate resource level, functioning as an individual. Zestix has been involved in significant data breaches, notably targeting organizations in the transportation and government sectors.

Victimology

Zestix has targeted various industries, including:

• Transportation: The actor claimed a breach of a major Spanish airline, resulting in the theft of 77GB of sensitive data.
• Government: The Brazilian military police were compromised through a third-party vendor, a healthcare company, leading to the theft of over 2TB of data, including sensitive medical records.

Regions affected by Zestix’s activities include:

• Spain: Specifically, the breach of a spanish airline.
• Brazil: Targeting the Brazilian military police and associated healthcare data.

TTPs (Tactics, Techniques, and Procedures)

Key attack patterns associated with Zestix include:

• Data Exfiltration: The actor has demonstrated capabilities in extracting large volumes of sensitive data from compromised systems.
• Third-Party Vendor Compromise: Zestix exploited vulnerabilities in third-party services, as seen in the breach involving Maida Health.
• Accessing Internal Systems: The actor successfully gained access to internal servers of targeted organizations, indicating a sophisticated understanding of network security.

Community Presence

Zestix is active on forums, particularly on forum.exploit.in, where the actor engages in discussions related to cybersecurity techniques and data leaks. The actor has shared insights on bypassing security measures and has posted details about data leaks from various organizations, including a major Spanish Airline and a health company. Communication appears to be facilitated through platforms like qTox, where Zestix has shared user IDs for contact.

Recently Zestix has also been very active on Breach Forums

About Check Point External Risk Management (formerly Cyberint)

Check Point’s External Risk Management solution is built to uncover threats before they cause damage. By continuously monitoring forums, credential abuse, and chatter across the open, deep and dark web, the team can detect campaigns in their earliest stages. The platform’s ability to correlate indicators across multiple clusters—ads, domains, Telegram activity, and more—helps link disparate attacks to a single network. That’s how we move fast, disrupt infrastructure, and protect organizations.