RUBYCARP is a financially-motivated botnet group likely based in Romania, known for operating for at least a decade, though only recently attributed and profiled by Sysdig in early 2024. This group is distinguished by its primary objective of financial gain through extensive cryptomining, distributed denial-of-service (DDoS) attacks, and targeted phishing campaigns. Unlike state-sponsored groups, RUBYCARP focuses on illicit monetization and has developed a unique operational model that includes mentoring new cybercriminals and selling their custom toolsets. While sometimes loosely associated with the Outlaw APT due to shared common tactics, techniques, and procedures, this connection is not definitive, and RUBYCARP operates as a distinct criminal entity.