A new threat actor group known as ShadowSyndicate, formerly known as Infra Storm, has recently come onto the scene using a wide variety of ransomware families in the past year. The threat actor has been linked to ransomware such as Quantum, BlackCat, Cl0p, Cactus, Nokoyawa, Play, and Royal. They are also known to deploy tools such as Cobalt Strike, Sliver, and IcedID in conjunction with their use of ransomware. The infrastructure for this threat group was discovered and mapped by researchers using an SSH fingerprint that was then traced to eighty-five (85) different servers. Of those eighty-five (85), fifty-two (52) of them were identified as being used as command-and-control (C2) servers for Cobalt Strike. Researchers also described how many of these servers are being attributed to multiple types of ransomwares, noting that the infrastructure appears to be shared between the different Ransomwares-as-a-Service (RaaS). Researchers also noted that there were IP addresses and past SSH clusters from ShadowSyndicate that were linked to Cl0p, indicating that there is possibly a connection between the two (2) threat groups or that they are sharing infrastructure. The identified servers were primarily located in Central America and Europe, specifically Panama, Cyprus, and Russia. CTIX analysts will continue to monitor the activity of this new group as well as their evolving tactics, techniques, and procedures (TTPs).