EMPERADOR Ransomware Gang: 6 New Leak-Site Listings Across Government, Healthcare & Transportation — Analysis & Detection Rules

Classification: TLP:CLEAR | Publication Date: 2026-09-24 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

The EMPERADOR ransomware operation has published six new listings on its dark web leak site in the past week, naming organizations across transportation, government & defense, healthcare, professional services, and manufacturing sectors in the United States, Brazil, Italy, and Sweden. Among the named organizations are OnTrac (Transportation, US), Receita Federal do Brasil (Government & Defense, BR), Alabama Woman's Health Care (Healthcare, US), Studio Notarile Associato Salvatore Costantino E Anna Favarato (Professional Services, IT), Cassias MG Government (Government & Defense, BR), and Electrolux (Manufacturing, SE).

It is critical to understand what this data is: these are claims made by a criminal organization on its own extortion infrastructure. EMPERADOR claims to have compromised these organizations. No listing in this dataset constitutes confirmation of a breach, and only the named organizations or their regulators can confirm or deny an incident. Security teams at organizations in the targeted sectors should treat this briefing as a trigger for proactive threat hunting against EMPERADOR's known tradecraft — not as confirmation that any specific intrusion occurred.

Sourcing & Verification

• Corroboration status: Of the 6 listings analyzed, 2 were independently observed by a second leak-site crawler (OnTrac and Receita Federal do Brasil). The remaining 4 listings appear on a single source only (ransomware.live), meaning we cannot independently confirm the gang even made those postings.
• What corroboration means: Multi-source confirmation tells us only that EMPERADOR published the claim. It does not confirm a breach occurred. No corroboration tier in this data confirms an intrusion — only the named organization or its regulator can do that.
• Named organizations may dispute these listings. A denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — EMPERADOR

EMPERADOR operates as a ransomware-as-a-service (RaaS) platform with a closed-core developer team and a rotating affiliate base, a model consistent with the operational security posture of mid-tier post-Conti ecosystem groups. Key characteristics observed across its activity:

• Aliases / overlaps: EMPERADOR-branded leak infrastructure; affiliate overlap and tooling reuse with post-LockBit and former BlackCat/ALPHV affiliates has been reported in underground chatter, though definitive attribution of personnel remains murky.
• Ransom demands: Typically scaled to perceived victim revenue, ranging from mid-six figures for regional professional services firms to seven figures for manufacturing and logistics targets. Negotiation portals on the gang's .onion infrastructure use per-victim tokens.
• Initial access methods (known TTPs): Exploitation of internet-facing edge devices (VPN concentrators, firewall management planes, virtualization infrastructure), credential-based access via RDP and VPN after brute-force or credential-stuffing, phishing with macro-enabled or link-based payloads, and procurement of access from initial access brokers (IABs).
• Double extortion: Standard practice — data is staged and exfiltrated before encryption; leak-site publication follows failed or stalled negotiations. The six listings in this dataset reflect that extortion cadence.
• Average dwell time: Estimated at 5–14 days from initial access to detonation, with data staging and exfiltration typically occurring 48–72 hours before encryption.
• Tooling: PsExec and WMI for lateral movement, Cobalt Strike and Sliver beacons for C2, Rclone/MEGA for exfiltration, and legitimate admin tooling (AnyDesk, Atera) masquerading as IT operations.

Current Campaign Analysis

Sector Targeting

EMPERADOR's recent listings span five sectors: Transportation (OnTrac, US), Government & Defense (Receita Federal do Brasil, BR; Cassias MG Government, BR), Healthcare (Alabama Woman's Health Care, US), Professional Services (Studio Notarile Associato Salvatore Costantino E Anna Favarato, IT), and Manufacturing (Electrolux, SE). The mix of a national tax authority claim alongside a regional municipal government claim and a small notarial practice suggests opportunistic affiliate-driven targeting rather than a tightly curated strategic campaign — affiliates hit what their access brokers sell.

Geographic Concentration

The campaign shows a dual concentration in the United States and Brazil (2 listings each), with single listings in Italy and Sweden. Brazil-focused government targeting is notable: government entities in Latin America frequently carry cyber insurance exclusions or limited budgets, making them attractive extortion targets with high public pressure.

Victim Profile

The claimed victim set spans a wide revenue band: large multinational manufacturing and national logistics operations (multi-billion USD revenue tier), federal and municipal government entities, and small professional services and healthcare practices (sub-$10M revenue). This spread is characteristic of RaaS operations where affiliates of differing sophistication operate in parallel under one brand.

Posting Frequency & Escalation

Six listings over five days (2026-09-19 through 2026-09-23) represents a notable burst for EMPERADOR. The clustering of postings in 24–48 hour windows is consistent with batch negotiation failures — multiple victims' countdown timers expiring simultaneously — rather than simultaneous intrusions.

CVE Exposure Hypotheses (Not Victim-Linked)

We have no evidence linking any specific CVE to any specific listing above. However, EMPERADOR's known initial access tradecraft aligns with several vulnerabilities currently on the CISA Known Exploited Vulnerabilities catalog with confirmed ransomware use. Defenders in the targeted sectors should treat the following as priority exposure hypotheses:

• CVE-2026-59310 (VMware vCenter path traversal): Hypervisor-layer compromise is a hallmark of double-extortion operations — control of vCenter enables mass encryption of virtualized estates. Any organization with vCenter reachable from untrusted networks should treat this as critical.
• CVE-2026-20316 (Cisco Secure FMC hard-coded password): Management-plane compromise of perimeter firewalls aligns with EMPERADOR's edge-device access pattern.
• CVE-2026-50751 (Check Point Security Gateway improper authentication, IKEv1): VPN gateway exploitation maps directly to the gang's known VPN access vector.
• CVE-2026-63077 (JetBrains TeamCity deserialization): Build-server compromise enables supply-chain-adjacent access and code signing key theft — relevant to manufacturing and software-adjacent targets.
• CVE-2026-48027 (Nx Console embedded malicious code): Developer workstation supply-chain exposure; a plausible phishing-adjacent ingress path.

Patch posture against these KEV entries should be validated today in transportation, government, healthcare, and manufacturing environments.

Detection Engineering

The following detections target EMPERADOR's documented tradecraft: edge/VPN exploitation, phishing payload execution, PsExec/WMI lateral movement, Cobalt Strike beaconing, and pre-encryption data staging.

---
title: EMPERADOR - Suspicious PsExec Service Creation for Lateral Movement
id: 8f2a1c3e-7b1d-4e5f-9a6c-emperador001
status: experimental
description: Detects PsExec-style remote service creation patterns associated with EMPERADOR affiliate lateral movement, including random-named services and ADMIN$ writes.
author: Security Arsenal Threat Intelligence
date: 2026/09/24
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec_img:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\PsExec.exe'
      - '\psexec64.exe'
  selection_service_create:
    EventID: 7045
    ServiceFileName|contains:
      - 'ADMIN$'
      - '\\.\pipe\'
  selection_random_svc:
    EventID: 7045
    ServiceName|re: '^[A-Za-z0-9]{8,16}$'
  condition: selection_psexec_img or selection_service_create or selection_random_svc
falsepositives:
  - Legitimate administrative use of PsExec by IT teams
  - EDR/remote management tooling
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
---
title: EMPERADOR - Pre-Encryption Data Staging and Exfiltration via Rclone or Cloud Sync
id: 8f2a1c3e-7b1d-4e5f-9a6c-emperador002
status: experimental
description: Detects execution of Rclone or renamed copy-tools with cloud storage endpoints, consistent with EMPERADOR pre-encryption exfiltration staging.
author: Security Arsenal Threat Intelligence
date: 2026/09/24
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_rclone_cmd:
    CommandLine|contains:
      - 'rclone copy'
      - 'rclone move'
      - 'rclone sync'
      - 'mega.co.nz'
      - 'mega.nz'
      - 'dropbox.com'
      - 'transfer.sh'
  selection_suspicious_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
  selection_exfil_proc_names:
    OriginalFileName: 'rclone.exe'
  condition: selection_rclone_cmd or (selection_suspicious_path and selection_exfil_proc_names)
falsepositives:
  - Legitimate cloud backup operations by IT
level: critical
tags:
  - attack.exfiltration
  - attack.t1567.002
---
title: EMPERADOR - Phishing Payload Macro Spawning Office Child Process
id: 8f2a1c3e-7b1d-4e5f-9a6c-emperador003
status: experimental
description: Detects Microsoft Office applications spawning script interpreters or download utilities, a common EMPERADOR phishing payload execution chain.
author: Security Arsenal Threat Intelligence
date: 2026/09/24
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\OUTLOOK.EXE'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate macro-driven automation
level: high
tags:
  - attack.initial_access
  - attack.t1204.002

The following Microsoft Sentinel query hunts for the pre-ransomware staging window — the 48–72 hours in which EMPERADOR affiliates typically enumerate hosts, move laterally via WMI/PsExec, and stage data before detonation:

// EMPERADOR pre-ransomware staging hunt: lateral movement + staging indicators, last 7 days
let Lookback = 7d;
let WMILateral =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4688
    | where Process has_any ("wmic.exe", "powershell.exe", "psexec", "psexesvc")
    | where CommandLine has_any ("/node:", "\\admin$", "invoke-command", "enter-pssession", "-computername")
    | project WMITime=TimeGenerated, Computer, Account, Process, CommandLine;
let StagingProcs =
    DeviceProcessEvents
    | where TimeGenerated >= ago(Lookback)
    | where ProcessCommandLine has_any ("rclone", "mega", "vssadmin delete shadows", "wbadmin delete", "bcdedit", "wevtutil cl")
    | project StageTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;
let MassFileRename =
    DeviceFileEvents
    | where TimeGenerated >= ago(1d)
    | where ActionType == "FileRenamed"
    | summarize RenameCount = count() by DeviceName, bin(TimeGenerated, 5m)
    | where RenameCount > 200;
WMILateral
| join kind=inner (StagingProcs) on $left.Computer == $right.DeviceName
| extend TimeDelta = StageTime - WMITime
| project WMITime, StageTime, Computer, Account, LateralCmd=CommandLine, StageCmd=ProcessCommandLine, TimeDelta
| union (MassFileRename | project WMITime=TimeGenerated, StageTime=TimeGenerated, Computer=DeviceName, Account="n/a", LateralCmd="mass-rename", StageCmd=strcat("Rename burst: ", RenameCount), TimeDelta=time(0))
| order by StageTime desc;

The following PowerShell script gives incident responders a rapid triage of EMPERADOR's common persistence and pre-encryption artifacts — run it on suspected staging hosts and domain controllers:

# EMPERADOR Rapid Triage: persistence, shadow copies, RDP exposure
# Run elevated. Outputs to C:\IR-Triage\emperador-triage.txt
$out = "C:\IR-Triage"; New-Item -ItemType Directory -Path $out -Force | Out-Null
$log = "$out\emperador-triage.txt"
"=== EMPERADOR RAPID TRIAGE $(Get-Date -Format o) on $env:COMPUTERNAME ===" | Out-File $log

"`n--- [1] Scheduled tasks created in last 7 days ---" | Out-File $log -Append
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{ Task=$_.TaskName; Path=$_.TaskPath; Author=$_.Author }
} | Where-Object { $_.Author -and (Get-Date) - (New-DateIfPossible $_.Author) } | Out-Null  # placeholder guard
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TaskScheduler/Operational'; Id=106; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Message | Format-List | Out-File $log -Append

"`n--- [2] New local admins in last 14 days ---" | Out-File $log -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Message | Format-List | Out-File $log -Append

"`n--- [3] Volume Shadow Copy status (deletion attempts = encryption imminent) ---" | Out-File $log -Append
vssadmin list shadows 2>&1 | Out-File $log -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=524} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Message | Format-List | Out-File $log -Append

"`n--- [4] RDP exposure check ---" | Out-File $log -Append
$rdp = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($rdp) { "WARNING: RDP LISTENING on this host: $($rdp | Select-Object -First 1 LocalAddress,LocalPort | Out-String)" | Out-File $log -Append }
else { "RDP not listening locally." | Out-File $log -Append }

"`n--- [5] Suspicious services (random 8-16 char names, PsExec artifacts) ---" | Out-File $log -Append
Get-Service | Where-Object { $_.Name -match '^[A-Za-z0-9]{8,16}$' -or $_.Name -match 'PSEXESVC' } |
  Select-Object Name, DisplayName, Status, StartType | Format-Table | Out-File $log -Append

"`n--- [6] Known exfil/staging tool presence ---" | Out-File $log -Append
foreach ($p in 'C:\ProgramData','C:\Users\Public',"$env:TEMP") {
  Get-ChildItem -Path $p -Recurse -Include 'rclone*','*mega*','winscp*','filezilla*' -ErrorAction SilentlyContinue |
    Select-Object FullName, CreationTime | Format-List | Out-File $log -Append
}
"=== TRIAGE COMPLETE: $log ==="

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

EMPERADOR's typical 5–14 day dwell time creates a detection window. Prioritize hunting for:

1. Shadow copy deletion commands — vssadmin delete shadows, wbadmin delete catalog, bcdedit /set recoveryenabled no. This is the strongest signal that detonation is minutes-to-hours away.
2. Mass file rename or modification bursts on file servers and hypervisors.
3. New scheduled tasks or services with random names on multiple hosts in a short window.
4. WMI/PsExec execution fan-out from a single workstation — classic staging-from-patient-zero behavior.
5. Egress spikes to consumer cloud storage (MEGA, Dropbox) or unfamiliar endpoints, especially from servers.
6. EDR tampering events — sensor service stops, tamper-protection bypass attempts, log clearing (wevtutil cl).

Critical Assets EMPERADOR Prioritizes for Exfiltration

Based on the sectors in this campaign, expect targeting of: financial and tax records (government/revenue authorities), patient records (healthcare), shipment and customer PII databases (transportation/logistics), legal and notarial documents (professional services), and IP/CAD/ERP data (manufacturing). Hypervisor management planes (vCenter) and backup infrastructure are prioritized for destruction to foreclose recovery.

Containment Actions by Urgency

1. Immediately isolate any host exhibiting shadow-copy deletion or mass renames — network-level isolation, not just agent-based (assume agent tampering).
2. Disable compromised accounts and force credential resets for any account observed in lateral movement telemetry; check for forged Kerberos tickets.
3. Block egress to consumer cloud storage and newly registered domains at the proxy/firewall.
4. Snapshot and preserve vCenter and backup infrastructure logs before attackers destroy them.
5. Verify backup integrity offline — EMPERADOR affiliates target backup catalogs early in the intrusion.
6. Engage IR retainers and legal/comms counsel before engaging with extortion portals; do not let negotiation timers drive your containment timeline.

Hardening Recommendations

Immediate (24 Hours)

• Patch or isolate internet-facing instances of VMware vCenter (CVE-2026-59310), Cisco Secure FMC (CVE-2026-20316), and Check Point gateways (CVE-2026-50751). If patching cannot complete today, remove management interfaces from internet reachability entirely.
• Block Office child-process execution via Attack Surface Reduction rules (matches the Sigma rule above) — this would have broken the phishing execution chain in numerous EMPERADOR-affiliate intrusions.
• Disable WDigest, enforce LAPS, and MFA all remote access (VPN and RDP) — credential replay against edge devices is the gang's bread and butter.
• Alert on vssadmin delete shadows and Event ID 524 across all servers; page on-call when it fires.
• Deny outbound MEGA/Dropbox/Rclone endpoints at egress proxies for servers.

Short-Term (Two Weeks)

• Segment backup infrastructure onto isolated credentials and networks; implement immutable/air-gapped backup copies with a tested restore runbook.
• Deploy tiered administration — prevent workstation-level credentials from reaching servers and domain controllers; EMPERADOR affiliates live off harvested admin creds.
• Restrict PsExec/WMI remote service creation to a jump-host allowlist and alert on all other usage (the Sigma and KQL content above operationalizes this).
• Implement application control (WDAC/AppLocker) blocking unapproved binaries in user-writable paths — blunts staging tool deployment.
• Conduct a purple-team exercise against the detections in this briefing; an untested Sigma rule is a hypothesis, not a control.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub