Classification: TLP:CLEAR | Publication Date: 2026-09-25 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

ENDZONE Ransomware Gang: 3 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules

Executive Summary

Between 2026-09-21 and 2026-09-24, the ENDZONE ransomware operation published three new listings on its dark web leak site, naming eTeam (Professional Services), Trump Mobile (Technology, US), and Gomomentum.com (sector unclassified). All three listings are unverified threat-actor claims — none have been independently corroborated by a second leak-site crawler, and none constitute confirmation of a breach.

The cluster is small but operationally relevant: three postings in four days indicates an active claim cadence, and the named organizations skew toward US-based professional services and technology firms — sectors that typically hold dense concentrations of client data, credentials, and intellectual property attractive to double-extortion operators. Security teams in these verticals should treat this as a trigger for proactive threat hunting against ENDZONE's known tradecraft, not as confirmation that any specific named organization has been compromised.

Sourcing & Verification

Readers must understand the epistemic status of everything that follows:

• 0 of 3 listings in this dataset were independently observed by a second leak-site crawler. All three — eTeam, Trump Mobile, and Gomomentum.com — appear on a single source only (ransomware.live aggregation of the gang's .onion site). Single-source status means we cannot even confirm the posting exists as displayed, let alone that an intrusion occurred.
• Inclusion in this briefing reflects the threat actor's claim, not confirmation of a breach. A leak-site posting is an accusation made by a criminal enterprise with financial incentive to exaggerate, fabricate, or recycle claims. No corroboration tier in our data confirms an intrusion — only the named organization or its regulator can do that.
• A named organization may dispute the listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — so neither silence nor denial settles the question.
• Security Arsenal will publish corrections to this briefing if new information emerges. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — ENDZONE

ENDZONE operates as a mid-tier ransomware operation with the following observed characteristics:

• Model: Closed-group operation with occasional affiliate recruitment. Unlike high-volume RaaS programs (e.g., LockBit-style open affiliate models), ENDZONE's low posting cadence — 3 listings across its last 100-posting window in this dataset — is consistent with a tighter operator structure that executes intrusions in-house or through a small trusted affiliate pool.
• Extortion approach: Double extortion. Data is staged and exfiltrated before encryption detonates; the leak site serves as the pressure mechanism, with organizations named publicly when negotiations stall. Partial data dumps typically follow 7–14 days after initial listing if payment is not made.
• Initial access methods (known tradecraft): Opportunistic exploitation of exposed edge services — VPN concentrators, firewall management planes, and virtualized infrastructure — supplemented by spear-phishing with macro-enabled documents and purchased access from initial access brokers (IABs). RDP brute force against internet-exposed endpoints remains in their playbook for smaller targets.
• Typical ransom demands: Proportional to victim revenue estimates, generally in the low-to-mid six figures USD for mid-market organizations, denominated in Monero or Bitcoin.
• Dwell time: Observed dwell time before detonation in comparable mid-tier operations runs 5–11 days, with the final 48 hours dominated by staging, shadow copy deletion, and mass encryption. This window is the defender's opportunity.

Current Campaign Analysis

Named Listings (Unverified Claims)

Sector and Geographic Concentration

The identifiable listings concentrate on Professional Services and Technology, with the only confirmed country tag being the United States. This is consistent with ENDZONE's historical preference for US mid-market targets where cyber insurance coverage and regulatory pressure increase payment likelihood. Professional services firms are attractive because they aggregate client-confidential data across many downstream organizations — a single compromise yields leverage over an entire client portfolio.

Victim Profile

Based on the named organizations' public profiles, ENDZONE appears to be targeting small-to-mid-market organizations rather than Fortune-scale enterprises. This matches their operational model: mid-market firms typically have lean security teams, incomplete EDR coverage, and perimeter infrastructure (VPNs, firewalls, virtualization hosts) that lags on patching.

Posting Frequency and Escalation

Three postings in four days (09-21, 09-23, 09-24) suggests either a batch of intrusions reaching the extortion phase simultaneously or a deliberate cadence to maintain leak-site visibility. With only 3 listings in the trailing 100-posting dataset, ENDZONE is a low-volume operator — meaning each named listing likely represents a genuinely worked intrusion attempt rather than spray-and-pray claim inflation. Defenders should not dismiss the low count; low-volume groups often have higher per-claim accuracy than mass-market RaaS brands.

CVE Exposure — Hypothesis, Not Attribution

We have no evidence linking any specific named listing to any specific CVE. However, ENDZONE's documented preference for edge-service exploitation aligns with several vulnerabilities currently on the CISA Known Exploited Vulnerabilities (KEV) catalog with confirmed ransomware use. Security teams should assess exposure to the following as a sector-level hypothesis:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Direct perimeter bypass; the exact class of bug ENDZONE-type operators favor for initial access. Added to KEV 2026-06-08.
• CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password. Management-plane compromise of the firewall itself. Added to KEV 2026-07-29.
• CVE-2026-59310 — VMware vCenter path traversal. Hypervisor-layer access enables mass encryption of entire virtual estates in a single detonation — the highest-leverage target in a modern enterprise. Added to KEV 2026-08-18.
• CVE-2026-63077 — JetBrains TeamCity deserialization. CI/CD compromise enables supply-chain-style payload distribution and credential harvesting from build agents — particularly relevant to technology-sector targets. Added to KEV 2026-08-05.
• CVE-2026-48027 — Nx Console embedded malicious code. Developer-workstation supply chain exposure. Added to KEV 2026-05-27.

If you run Check Point gateways, Cisco FMC, vCenter, or TeamCity and have not patched these, you are in the exposed population for this class of actor regardless of whether ENDZONE specifically targets you.

Detection Engineering

The following detections target ENDZONE's known tradecraft: edge-service exploitation, macro-based phishing execution, lateral movement via PsExec/WMI, pre-encryption staging, and defense impairment (shadow copy deletion).

---
title: ENDZONE Initial Access - Suspicious Child Process from VPN or Firewall Management Plane
id: 9f3a1c2e-7b4d-4e1a-a5f6-endzone00001
status: experimental
description: Detects shell or scripting interpreters spawned by VPN concentrator, firewall management, or vCenter processes — consistent with post-exploitation following edge-service exploitation (e.g., Check Point CVE-2026-50751, Cisco FMC CVE-2026-20316, vCenter CVE-2026-59310). Hypothesis-level detection for ENDZONE-style initial access.
author: Security Arsenal Threat Intelligence
date: 2026/09/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\fw1\'
      - '\checkpoint\'
      - 'httpd'
      - 'tomcat'
      - 'vpxd'
      - 'java.exe'
      - 'nginx.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate management plane updates and health-check scripts
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1059
---
title: ENDZONE Pre-Encryption Staging - Shadow Copy Deletion and Backup Tampering
id: 9f3a1c2e-7b4d-4e1a-a5f6-endzone00002
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and boot configuration changes — the canonical T-minus indicator executed in the final hours before ransomware detonation in ENDZONE-style double-extortion operations.
author: Security Arsenal Threat Intelligence
date: 2026/09/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains: 'delete catalog'
  condition: 1 of selection_*
falsepositives:
  - Rare; some backup software manages shadow copies legitimately. Correlate with process lineage and user context.
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
---
title: ENDZONE Lateral Movement - PsExec Service Install or Remote WMI Process Creation
id: 9f3a1c2e-7b4d-4e1a-a5f6-endzone00003
status: experimental
description: Detects PsExec-style remote service installation (PSEXESVC) and WMI remote process creation, both staples of mid-tier ransomware operators during lateral spread from the initial foothold toward file servers and hypervisors.
author: Security Arsenal Threat Intelligence
date: 2026/09/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith: '\PSEXESVC.exe'
  selection_paexec_clone:
    Image|endswith:
      - '\PAExec.exe'
      - '\csexec.exe'
  selection_wmi_remote:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\net.exe'
      - '\nltest.exe'
      - '\xcopy.exe'
      - '\robocopy.exe'
  condition: 1 of selection_*
falsepositives:
  - Administrative tooling and software deployment systems. Whitelist known management hosts.
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047

The following Microsoft Sentinel KQL query hunts for pre-ransomware staging behavior: a single host exhibiting the rapid sequence of mass file access, archive utility execution, shadow copy tampering, and outbound SMB/RDP lateral connections within a compressed window — the behavioral signature of ENDZONE's final 48 hours.

// ENDZONE pre-detonation staging hunt — correlate staging behaviors within 6-hour windows
let Lookback = 14d;
let Window = 6h;
let SuspiciousHosts =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no",
                                        "delete catalog", "ignoreallfailures")
    | summarize ShadowCopyEvents = count(), FirstSeen = min(TimeGenerated) by DeviceName;
let ArchiveStaging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("7z.exe", "rar.exe", "winrar.exe", "7za.exe")
       or ProcessCommandLine has_any (" a -t", " -mx", " -p")
    | summarize ArchiveRuns = count() by DeviceName;
let LateralSpread =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemotePort in (445, 3389, 5985, 5986)
    | where ActionType == "ConnectionSuccess"
    | summarize LateralTargets = dcount(RemoteIP), TargetList = make_set(RemoteIP, 20) by DeviceName;
SuspiciousHosts
| join kind=inner ArchiveStaging on DeviceName
| join kind=inner LateralSpread on DeviceName
| where LateralTargets > 3
| extend RiskScore = (ShadowCopyEvents * 30) + (ArchiveRuns * 10) + (LateralTargets * 5)
| project DeviceName, FirstSeen, ShadowCopyEvents, ArchiveRuns, LateralTargets, TargetList, RiskScore
| order by RiskScore desc

Run this query on any host in the blast radius of your edge services (VPN gateways, firewall management stations, vCenter-adjacent jump boxes) and on file servers holding client-confidential data. A hit on all three legs of the join — shadow copy tampering AND archive staging AND fan-out lateral connections — is a near-certain pre-detonation signal and should trigger your ransomware IR runbook immediately, not your standard triage queue.

The following PowerShell script performs rapid-response checks for the most common ENDZONE-style persistence and staging artifacts on a suspected host: scheduled tasks created in the last 7 days, shadow copy status, recent suspicious service installations, and local admin group changes.

# Security Arsenal — Rapid Ransomware Staging Assessment
# Run as Administrator on any host suspected of compromise staging
# Output: console report + JSON artifact for IR case file

$report = [ordered]@{}
$report['Hostname'] = $env:COMPUTERNAME
$report['ScanTime'] = (Get-Date).ToString('o')

# 1. Scheduled tasks created or modified in the last 7 days
$report['RecentScheduledTasks'] = Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        TaskName    = $_.TaskName
        TaskPath    = $_.TaskPath
        Author      = $_.Author
        LastRunTime = $info.LastRunTime
    }
} | Where-Object { $_.LastRunTime -gt (Get-Date).AddDays(-7) }

# 2. Volume Shadow Copy status — ransomware staging deletes these
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$report['ShadowCopyCount'] = ($shadows | Measure-Object).Count
$report['ShadowCopyWarning'] = if ($report['ShadowCopyCount'] -eq 0) {
    'CRITICAL: No shadow copies present — possible anti-recovery tampering'
} else { 'OK' }

# 3. Services installed in the last 7 days (PsExec clones, ransomware payloads)
$cutoff = (Get-Date).AddDays(-7)
$report['RecentServices'] = Get-CimInstance Win32_Service | ForEach-Object {
    $path = $_.PathName -replace '"', ''
    $exe = ($path -split ' ')[0]
    if (Test-Path $exe -ErrorAction SilentlyContinue) {
        $created = (Get-Item $exe).CreationTime
        if ($created -gt $cutoff) {
            [PSCustomObject]@{
                ServiceName = $_.Name
                DisplayName = $_.DisplayName
                PathName    = $_.PathName
                Created     = $created
                State       = $_.State
            }
        }
    }
}

# 4. Local Administrators group — flag recently added accounts
$report['LocalAdmins'] = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
    Select-Object Name, ObjectClass, PrincipalSource

# 5. RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' `
    -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
$nlaEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
    -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
$report['RDPEnabled']  = ($rdpEnabled -eq 0)
$report['RDPWithNLA']  = ($nlaEnabled -eq 1)
$report['RDPWarning']  = if ($report['RDPEnabled'] -and -not $report['RDPWithNLA']) {
    'HIGH: RDP enabled without NLA — brute-force exposure'
} elseif ($report['RDPEnabled']) { 'MEDIUM: RDP enabled; verify it is not internet-exposed' } else { 'OK' }

# 6. Archive utility execution artifacts (staging indicator)
$report['StagingArtifacts'] = Get-ChildItem -Path 'C:\Users\*\AppData\Roaming\Microsoft\Windows\Recent' `
    -ErrorAction SilentlyContinue | Where-Object {
        $_.Name -match '\.(7z|rar|zip)$' -and $_.LastWriteTime -gt $cutoff
    } | Select-Object Name, LastWriteTime

$report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\ENDZONE_RapidAssess_$($env:COMPUTERNAME).json"
$report.GetEnumerator() | ForEach-Object {
    Write-Host "`n=== $($_.Key) ===" -ForegroundColor Cyan
    $_.Value | Format-List
}

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

ENDZONE's playbook, like most double-extortion mid-tier operators, follows a predictable final 48–72 hours. Hunt for, in sequence:

1. Credential harvesting: LSASS memory access by non-system processes, DCSync-style replication requests from non-DC hosts, ntdsutil or vssadmin abuse targeting NTDS.dit.
2. Discovery burst: nltest /dclist, net group "Domain Admins", ADFind/SharpHound output files (*.json, *.csv bloodhound artifacts) on non-admin workstations.
3. Staging: Execution of 7z.exe/rar.exe against server shares, multi-GB outbound transfers to unfamiliar cloud storage or MEGA/rclone endpoints, archive files written to C:\ProgramData or user temp paths.
4. Defense impairment (the loud signal): vssadmin delete shadows, bcdedit recovery tampering, wbadmin delete catalog, EDR service stop attempts, mass event log clearing (Event 1102).
5. Pre-detonation lateral fan-out: simultaneous PsExec/WMI/SMB connections from one host to dozens of servers — the KQL query above is built for exactly this.

Critical Assets This Playbook Prioritizes for Exfiltration

• Client-confidential data held by professional services firms (engagement files, legal documents, financial records) — the leverage multiplier.
• Authentication databases and credential stores (NTDS.dit, password manager exports, CI/CD secrets — note the TeamCity exposure hypothesis above).
• Finance and HR data (payroll, tax documents, PII) for regulatory-pressure extortion.
• Hypervisor configurations and backups, which are destroyed or encrypted to eliminate recovery options.

Containment Actions, Ordered by Urgency

1. Isolate the staging host (the one running archive tools and shadow copy deletion) at the network layer — do NOT shut it down; memory holds encryption keys and actor tooling.
2. Disable compromised credentials globally — assume domain-level credential theft if discovery artifacts are present; force resets for all privileged accounts and revoke sessions/tokens.
3. Block egress to consumer cloud storage at the proxy/firewall immediately if staging indicators exist; double extortion dies without exfiltration.
4. Snapshot and isolate hypervisor management planes (vCenter especially, given CVE-2026-59310 exposure) — hypervisor encryption is the catastrophic outcome.
5. Verify backup integrity and offline copies before any remediation; if shadow copy tampering has occurred on servers, assume backup infrastructure is also targeted.
6. Preserve evidence — volatile memory, firewall/VPN logs, and the leak-site listing itself (screenshot with timestamps) for legal and insurance purposes.

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate the perimeter KEV set: Check Point Security Gateway (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), VMware vCenter (CVE-2026-59310). If patching is not possible in 24 hours, restrict management-plane access to a dedicated, MFA-protected admin VLAN.
• Confirm EDR coverage on servers and hypervisor-adjacent systems, not just workstations — mid-tier operators detonate on servers first.
• Block macro execution from internet-sourced Office documents (Mark-of-the-Web enforcement) and alert on any Office process spawning powershell.exe, wscript.exe, or certutil.exe.
• Audit internet-exposed RDP (script above) — disable or place behind VPN with NLA enforced.
• Deploy the Sigma rules above to your SIEM today; the shadow-copy rule (ENDZONE-00002) is critical severity and near-zero false positive.
• Block outbound traffic to consumer file-sharing/anon-file services not used by the business.

Short-Term (2 Weeks)

• Segment backup infrastructure onto an isolated network with immutable, offline, or air-gapped copies; enforce separate credentials for backup administration.
• Implement tiered administration — eliminate domain admin logons to workstations and member servers; credential theft is the bridge between initial access and hypervisor encryption.
• Deploy deception — canary files on file shares and honey credentials on servers. Mid-tier operators touch these during discovery and staging with near-perfect reliability.
• Restrict PsExec/WMI lateral paths via host firewall rules limiting SMB and WinRM to designated management hosts only.
• Review CI/CD security posture (TeamCity, developer tooling): rotate build-agent secrets, audit installed plugins, and verify integrity of developer-tooling supply chains given CVE-2026-63077 and CVE-2026-48027 exposure.
• Tabletop a double-extortion scenario — the decision points (negotiate, disclose, notify) must be pre-agreed by legal and executives before a leak-site listing forces them under a 72-hour clock.

This briefing reflects unverified claims published by a criminal enterprise on its dark web leak site. Security Arsenal monitoring of ENDZONE's infrastructure continues; updates and corrections will be published as corroboration status changes.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub