EMPERADOR Ransomware Gang: 3 New Victims Posted — Education & Manufacturing Targeting, KEV-Linked Access Paths

Classification: Threat Intelligence Bulletin — Dark Web Leak Site Monitoring
Date observed: 2026-09-17
Source: ransomware.live / gang .onion leak site posts; CISA KEV correlation
Confidence: Moderate-high on victim postings; moderate on access-vector linkage until forensic confirmation.

Threat Actor Profile — EMPERADOR

EMPERADOR appears to operate as a small-to-mid tier ransomware crew using double-extortion tradecraft: encryption plus leak-site publication to pressure payment. Public reporting on this specific brand remains limited, so defenders should treat the profile below as an assessed playbook rather than a fully attributed dossier.

• Known aliases: None confirmed in the current pull; monitor for rebrands, blog mirrors, and Telegram/TOX reposts using victim-name matching rather than actor-name matching.
• Operating model: Assessed closed or semi-closed RaaS-style operation. Low recent victim volume — 3 posts in the last 100 tracked postings — suggests either a newer crew, selective affiliate model, or a rebrand/quiet period rather than high-throughput enterprise RaaS.
• Typical ransom demands: Not reliably published for this cluster. Comparable crews targeting education and mid-market manufacturing commonly demand low-to-mid six figures USD, scaling upward where cyber insurance, ERP downtime, safety systems, or regulated data increase leverage.
• Initial access methods to prioritize: Internet-facing edge exploitation, VPN/firewall management-plane compromise, exposed RDP or remote-access tooling, phishing with macro-enabled documents or HTML/JS loaders, and abused MSP/RMM channels. The KEV set listed below is consistent with edge-device and management-plane access rather than pure email-only intrusion.
• Extortion approach: Assessed double extortion: steal first, encrypt second, publish victim names after failed negotiation or deadline expiry. Education and manufacturing victims increase pressure through student data, IP/CAD drawings, supplier disruption, and plant downtime.
• Average dwell time: Unknown for EMPERADOR. Use ransomware-sector planning assumptions of 3–14 days from first access to detonation, with data staging often beginning 24–72 hours before encryption.

Current Campaign Analysis

Observed leak-site posts:

• Westbridge Institute of Technology, Inc. — Education — published 2026-09-17
• RDA MOTORS S.P.A. — Manufacturing, Italy — published 2026-09-16
• SEVENOAKS s.r.o. — sector not found, Czech Republic — published 2026-09-16

Sector targeting: Education and manufacturing are directly represented; the Czech victim is unclassified but the cluster still indicates opportunistic European mid-market pressure rather than a single-vertical operation. Education victims often have weaker endpoint coverage, seasonal staffing gaps, exposed remote access for vendors, and high sensitivity around student records. Manufacturing victims often have flat OT/IT adjacency, legacy SMB, ERP/MES dependencies, and high willingness to pay to restore production.

Geographic concentration: Italy and Czech Republic are confirmed; one victim lacks reliable geolocation. Treat this as an EU-focused pulse with possible spillover into organizations using Italian/Czech suppliers, shared MSPs, or European edge infrastructure.

Victim profile: Likely small-to-mid enterprise: technical institute, automotive/industrial manufacturer, and an unclassified Czech LLC. Estimated revenue bands are probably approximately $5M–$250M, where ransom operations can create maximum disruption without triggering the same law-enforcement heat as critical national infrastructure.

Posting frequency / escalation: Three posts across two days indicates a short burst after access maturation. If the next 72 hours produce additional posts, expect either batch detonation from a single initial-access broker or one affiliate working a regional edge-vulnerability list.

CVE correlation: No public evidence yet proves EMPERADOR used these exact CVEs, but the CISA KEV timing is actionable for threat modeling:

• CVE-2026-59310 — Broadcom VMware vCenter path traversal: prioritize virtualization control plane, backup infrastructure, and domain-wide blast radius.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password: management-plane compromise can expose firewall policy, VPN config, and admin credentials.
• CVE-2026-50751 — Check Point Security Gateway improper authentication in IKEv1: direct edge/VPN access path.
• CVE-2026-48027 — Nx Console embedded malicious code: developer workstation supply-chain path into source, secrets, and build systems.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal/RCE: RMM abuse is a proven ransomware precursor and should be hunted even if patching occurred months ago.

Detection Engineering

---
title: EMPERADOR - Edge VPN or Management Plane Follow-On Admin Logon
id: 9d2a7f41-emp-0001-4d2f-9f10-edgeransom
status: experimental
description: Detects suspicious interactive or service logons shortly after authentication on VPN, firewall management, vCenter, ScreenConnect, or remote access infrastructure associated with ransomware initial access.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Detection Engineering
date: 2026/09/17
modified: 2026/09/17
logsource:
  category: authentication
  product: windows
detection:
  selection_event:
    EventID:
      - 4624
      - 4625
  selection_remote:
    LogonType:
      - 3
      - 10
    IpAddress|contains:
      - vpn
      - sslvpn
      - anyconnect
      - globalprotect
      - checkpoint
      - firepower
      - fmc
      - screenconnect
      - rdp
  filter_known_good:
    WorkstationName|endswith:
      - '-SOC'
      - '-PAM'
  condition: selection_event and selection_remote and not filter_known_good
falsepositives:
  - Managed service provider administrative access
  - PAM checkouts and jump-host administration
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1190
  - attack.t1078
---
title: EMPERADOR - Phishing Loader to Office Macro or Script Child Process
id: 6c1b8e22-emp-0002-4aa1-b511-phishstage
status: experimental
description: Detects Office, browser, or archive utility processes spawning script interpreters, mshta, rundll32, regsvr32, wmic, powershell, or curl shortly after user-context execution, consistent with ransomware loader chains.
references:
  - https://attack.mitre.org/techniques/T1204/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal Detection Engineering
date: 2026/09/17
modified: 2026/09/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\7z.exe'
      - '\winrar.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\curl.exe'
  selection_cli:
    CommandLine|contains:
      - 'http'
      - 'temp'
      - 'appdata'
      - 'programdata'
      - 'encodedcommand'
      - 'downloadstring'
      - 'invoke-expression'
      - 'start-process'
  condition: selection_parent and selection_child and selection_cli
falsepositives:
  - Enterprise software deployment
  - Browser-launched troubleshooting tools
level: high
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059
  - attack.t1105
---
title: EMPERADOR - Pre-Encryption Staging PsExec WMI VSS and Exfil Indicators
id: 2f77c990-emp-0003-49bc-a17e-prelock
status: experimental
description: Detects lateral movement and ransomware preparation including PsExec service creation, WMI remote process execution, shadow-copy deletion, backup tampering, and archive or cloud exfil staging before encryption.
references:
  - https://attack.mitre.org/techniques/T1569/002/
  - https://attack.mitre.org/techniques/T1047/
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal Detection Engineering
date: 2026/09/17
modified: 2026/09/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_lateral:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\wmic.exe'
      - '\wmiprvse.exe'
    CommandLine|contains:
      - '\\'
      - ' process call create'
      - ' /node:'
      - ' -s '
      - ' -d '
  selection_backup_tamper:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit'
      - 'wbadmin delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
  selection_stage_exfil:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winzip.exe'
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\filezilla.exe'
    CommandLine|contains:
      - ' a '
      - ' -hp'
      - ' copy '
      - ' sync '
      - ' --config'
  condition: 1 of selection_*
falsepositives:
  - Backup administrators running maintenance
  - EDR or vulnerability management service execution
level: critical
tags:
  - attack.lateral_movement
  - attack.impact
  - attack.exfiltration
  - attack.t1569.002
  - attack.t1047
  - attack.t1490
  - attack.t1048

// Microsoft Sentinel hunt: EMPERADOR-style pre-ransomware staging and lateral movement
// Look back 14 days; tune KnownAdminAccounts and KnownManagementHosts before production.
let KnownAdminAccounts = dynamic([]);
let KnownManagementHosts = dynamic([]);
let Start = ago(14d);
union withsource=SourceTable
(
  SecurityEvent
  | where TimeGenerated >= Start
  | where EventID in (4624, 4627, 4648, 4672, 7045, 4698, 4702)
  | extend Host = Computer, Account = tolower(coalesce(TargetUserName, SubjectUserName)), LogonType = tostring(LogonType), Ip = tostring(IpAddress), NewService = tostring(ServiceName)
),
(
  DeviceProcessEvents
  | where TimeGenerated >= Start
  | extend Host = DeviceName, Account = tolower(AccountName)
  | where FileName in~ ("psexec.exe","psexesvc.exe","wmic.exe","powershell.exe","pwsh.exe","cmd.exe","rclone.exe","7z.exe","rar.exe","vssadmin.exe","wbadmin.exe","bcdedit.exe")
     or ProcessCommandLine has_any ("shadowcopy delete","delete shadows","recoveryenabled no"," process call create","/node:","downloadstring","encodedcommand"," --config ")
  | extend Ip = tostring(RemoteIP), NewService = "", LogonType = ""
),
(
  DeviceNetworkEvents
  | where TimeGenerated >= Start
  | extend Host = DeviceName, Account = tolower(InitiatingProcessAccountName)
  | where RemotePort in (3389, 5985, 5986, 445, 135, 22, 443, 8443, 10000)
     or RemoteUrl has_any ("mega.nz","file.io","transfer.sh","anonfiles","gofile","temp.sh")
  | extend Ip = tostring(RemoteIP), NewService = "", LogonType = ""
)
| where not(Account in (KnownAdminAccounts)) and not(Host in (KnownManagementHosts))
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Events=count(), Signals=make_set(SourceTable), CommandLines=make_set(ProcessCommandLine), IPs=make_set(Ip), Services=make_set(NewService) by Host, Account
| where Events >= 3 or array_length(Signals) >= 2
| extend RiskScore = iff(CommandLines has_any ("delete shadows","recoveryenabled no","rclone"," --config "), 90, iff(array_length(Signals) >= 3, 70, 45))
| sort by RiskScore desc, LastSeen desc

# Rapid response: exposed RDP, suspicious 7-day tasks/services, shadow-copy and backup tamper check
$ErrorActionPreference = 'SilentlyContinue'
$since = (Get-Date).AddDays(-7)
$out = Join-Path $env:TEMP ('emperador_rapid_' + (Get-Date -Format 'yyyyMMdd_HHmmss') + '.txt')

"=== HOST: $env:COMPUTERNAME  TIME: $(Get-Date) ===" | Out-File $out

"`n[1] RDP status and listeners" | Out-File $out -Append
Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' | Select-Object fDenyTSConnections | Out-File $out -Append
Get-NetTCPConnection -State Listen | Where-Object LocalPort -in 3389,5985,5986 | Select-Object LocalAddress,LocalPort,OwningProcess | Format-Table -Auto | Out-File $out -Append

"`n[2] Scheduled tasks created/modified in last 7 days" | Out-File $out -Append
Get-ScheduledTask | ForEach-Object {
  $i = $_ | Get-ScheduledTaskInfo
  [pscustomobject]@{TaskName=$_.TaskName; TaskPath=$_.TaskPath; Author=$_.Author; LastRunTime=$i.LastRunTime; NextRunTime=$i.NextRunTime; State=$_.State; Actions=($_.Actions | ForEach-Object { ($_.Execute + ' ' + $_.Arguments) }) -join '; '}
} | Where-Object {$_.Author -notmatch 'Microsoft' -or $_.TaskPath -notlike '\Microsoft*'} | Sort-Object LastRunTime -Descending | Format-List | Out-File $out -Append

"`n[3] Services created in last 7 days" | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$since} | Select-Object TimeCreated, Message | Format-List | Out-File $out -Append

"`n[4] Shadow copies and backup deletion telemetry" | Out-File $out -Append
vssadmin list shadows | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Backup'; StartTime=$since} | Select-Object TimeCreated, Id, Message | Format-List | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$since} | Where-Object {$_.Message -match 'vssadmin|wbadmin|bcdedit|shadowcopy|recoveryenabled'} | Select-Object TimeCreated, Message | Format-List | Out-File $out -Append

"`n[5] Recent persistence and suspicious unsigned binaries in writable paths" | Out-File $out -Append
Get-ChildItem "$env:ProgramData","$env:APPDATA","$env:TEMP","$env:PUBLIC" -Recurse -Include *.exe,*.dll,*.ps1,*.bat,*.js,*.vbs -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt $since} | Select-Object FullName, LastWriteTime, Length | Sort-Object LastWriteTime -Descending | Format-Table -Auto | Out-File $out -Append

Write-Output ('Report written: ' + $out)

Incident Response Priorities

T-minus detection checklist — before encryption fires:

• New or abnormal admin logons from VPN, firewall FMC, Check Point, vCenter, ScreenConnect, or RDP outside normal change windows.
• Explicit credential use, Event ID 4648/4672 spikes, DCSync-like replication requests, or sudden net group / nltest / adfind discovery.
• PsExec service creation, WMI remote process creation, SMB admin$ writes, or WinRM enablement across server segments.
• Mass file reads against shares, archive creation in ProgramData, staging directories named backup, tmp, update, or random 8-character strings.
• vssadmin delete shadows, wbadmin delete catalog, bcdedit recoveryenabled no, backup job failure, or EDR service stop attempts.
• Egress to consumer file-transfer domains, rclone/mega/file.io, abnormal TLS to rare VPS ASNs, or sustained upload before business hours.

Critical assets this gang is likely to prioritize for exfiltration:

• For education: student information systems, identity stores, HR/payroll, financial aid, research shares, legal/Title IX files, and email archives.
• For manufacturing: ERP/MES exports, CAD/CAM and PLC-adjacent engineering files, supplier contracts, quality records, OT network diagrams, backup catalogs, and credentials for plant vendors.
• For all victims: domain controller ntds.dit, backup server config, cyber insurance policy, legal hold data, executive mailboxes, VPN/firewall configs, and incident-response contact trees.

Containment actions ordered by urgency:

1. Isolate suspected staging hosts and disable compromised VPN/firewall/RMM accounts; revoke sessions and tokens, not just passwords.
2. Block egress to file-transfer and newly seen VPS destinations at proxy, firewall, DNS, and EDR network layers.
3. Protect backups: pause replication to reachable backup repositories, enable immutable lock, rotate backup credentials, and verify offline restore points.
4. Freeze lateral movement: disable PsExec/remote service creation where possible, restrict WMI/WinRM to PAWs, and enforce SMB signing/LAPS rotation.
5. Preserve volatile evidence: memory on edge appliances and hypervisors, authentication logs from VPN/IdP/EDR, firewall FMC events, vCenter tasks, and RMM audit trails.
6. If encryption starts: segment by switch ACL/VLAN rather than powering everything down blindly; photograph ransom notes; capture encrypted file extension and shadow-copy state.
7. Engage counsel, insurer, and IR retainer early; do not contact the actor from corporate infrastructure and do not wipe staging hosts before imaging.

Hardening Recommendations

Immediate — 24 hours:

• Patch or isolate CISA KEV items listed above: VMware vCenter path traversal, Cisco Secure FMC hard-coded password, Check Point IKEv1 improper authentication, Nx Console malicious release path, and ScreenConnect path traversal/RCE. If patching cannot complete, remove management interfaces from internet reachability.
• Disable IKEv1 where not required; force MFA on VPN and firewall management; restrict FMC/vCenter/Check Point management to jump hosts and specific admin subnets.
• Block inbound RDP from the internet; require VPN plus device compliance; alert on any 3389/5985/5986 listener outside approved admin hosts.
• Enforce Office macro blocking from internet zones, attack surface reduction rules for Office child processes, script-interpreter logging, and SmartScreen/WDAC or AppLocker for user-writable paths.
• Deny PsExec service creation for standard admins; restrict WMI/WinRM; rotate KRBTGT twice if domain access is suspected; expire all VPN, IdP, RMM, and backup sessions.
• Verify Volume Shadow Copies cannot be deleted by server admins alone; alert on vssadmin, wbadmin, bcdedit, backup catalog deletion, and EDR tamper events.
• Add egress deny-by-default for servers where feasible; explicitly block rclone, MEGA, file.io, transfer.sh, anonfiles, GoFile, and unsanctioned FTP/SFTP.

Short-term — 2 weeks:

• Re-architect edge management planes behind PAM/jump hosts with phishing-resistant MFA, just-in-time admin, session recording, and separate credential domains for virtualization, backup, firewall, and OT-adjacent systems.
• Implement tiered administration and clean-source principle for Tier 0; deploy LAPS for local admin, gMSA for services, and disable cached credentials on servers.
• Deploy immutable, logically air-gapped backups with dual-control deletion and quarterly restore tests tied to ERP/MES and student information recovery objectives.
• Segment education research/admin networks and manufacturing IT from OT; add brokered vendor access for plant maintenance with time-bound approvals.
• Build detection coverage around pre-encryption behavior rather than ransom notes: staging archives, shadow-copy deletion, backup job tampering, rare outbound volume, and identity anomalies.
• Establish a dark-web leak monitoring playbook keyed to your organization, suppliers, brands, executives, and data categories so leak posts trigger evidence preservation and comms within minutes.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub