LAMASHTU Ransomware Gang: 7 Organizations Listed on Leak Site — FR/DE Sector Targeting Analysis & Detection Rules

Classification: TLP:CLEAR | Publication Date: 2026-10-25 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

Between 2026-10-21 and 2026-10-24, the ransomware group tracked as LAMASHTU published seven organization names on its dark web leak site. The listings are geographically concentrated in Germany (5) and France (2) and span Retail & E-Commerce, Manufacturing, Agriculture and Food Production, Energy & Utilities, and Other sectors. Manufacturing is the most represented sector (3 of 7 listings).

Every listing is an unverified accusation by a criminal actor. LAMASHTU claims to have compromised these organizations; this briefing does not assert, and the underlying data does not establish, that any named organization was breached. Two of the seven postings were independently observed by a second leak-site crawler (confirming the gang made the claim); five appear on a single crawler source only.

Security teams in the affected sectors and geographies — particularly German and French mid-market manufacturers, food producers, and regional utilities — should treat this as a trigger to run the detection content in this briefing against the last 30 days of telemetry, not as confirmation that any specific peer has been compromised.

Sourcing & Verification

• Corroboration tier: 2 of 7 listings (Vins Viallet, Hecker Holzsystembau) were independently observed by a second leak-site crawler. 5 of 7 listings appear on ransomware.live only, with no second-crawler confirmation that the posting even exists.
• What inclusion means: Inclusion in this briefing reflects the threat actor's claim as published on its leak site. It is not confirmation of a breach. No corroboration tier in this data confirms an intrusion — only the named organization or its regulator can do that.
• Disputes and denials: A named organization may dispute a listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and incident type, and not every incident is reportable. Neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — LAMASHTU

Public telemetry on LAMASHTU remains limited compared to high-volume RaaS brands; the profile below is assessed with low-to-moderate confidence and blends direct observation with patterns typical of groups operating at this cadence.

• Aliases / naming: Tracked publicly as LAMASHTU (named after the Mesopotamian demoness, a naming convention shared with several mid-tier crews). No widely adopted vendor aliases are established at this time.
• Operating model: Assessed as a closed group or tightly controlled affiliate program rather than an open RaaS. The low posting volume (7 victims in the most recent 100-post window analyzed) and tight sector/geo clustering are inconsistent with open affiliate operations, which typically produce higher-volume, geographically scattered posting.
• Ransom demands: No confirmed demand figures are public. Groups with this victim profile (European mid-market, estimated revenue €5M–€150M) typically open demands in the low-to-mid six figures USD equivalent, negotiable downward, with separate extortion for data non-publication.
• Initial access methods (assessed): Consistent with peer groups of this tier: exploitation of internet-facing edge and management infrastructure (VPN concentrators, firewalls, virtualization management planes, CI/CD servers), phishing with macro- or script-based payloads, and exposed RDP. See the CVE hypothesis discussion below.
• Extortion model: Double extortion — data theft prior to encryption, with leak-site publication used as leverage. The presence of a dedicated leak site and staged victim posting supports this assessment.
• Dwell time: Not directly observable from leak-site data. Comparable crews typically operate with days-to-weeks of dwell time between initial access and detonation, with exfiltration completed before encryption. Defenders should assume a minimum 7–14 day pre-detonation window in which the activity is detectable.

Current Campaign Analysis

Listings published 2026-10-21 through 2026-10-24

Sector targeting

Manufacturing dominates (3 of 7), followed by single listings across retail, food production, and energy/utilities. This is a classic mid-market European campaign profile: organizations large enough to pay, small enough to lack 24/7 SOC coverage, and operationally sensitive enough (production lines, perishable goods, utility service) to feel acute downtime pressure.

Geographic concentration

5 of 7 listings are German organizations; 2 are French. DACH-region concentration of this density usually reflects either a German-speaking operator/affiliate or a deliberate focus on Mittelstand-style targets, which historically underinvest in security relative to enterprise peers.

Victim profile

Based on the sectors named, the listing set skews toward small-to-mid enterprises — family-owned manufacturers, regional food/beverage producers, a municipal-scale utility — plausibly in the €5M–€150M revenue range. None of the listings are large-cap enterprises, consistent with a crew optimizing for payout probability over headline value.

Posting cadence / escalation pattern

All seven postings landed within a four-day window (2026-10-21 to 2026-10-24), a burst pattern rather than a drip. Burst posting typically indicates one of two things: (1) a batch of intrusions executed from a common access vector or access-broker purchase, or (2) victims who refused negotiation and were published simultaneously as leverage against remaining negotiators. Either way, defenders in the region should assume additional unlisted intrusions may be in progress right now.

CVE exposure hypotheses (sector-level — not victim attribution)

We have no evidence linking any specific CVE to any specific named listing. The following are actively exploited, ransomware-confirmed vulnerabilities from the CISA KEV that map to the infrastructure profile typical of this victim set. Treat them as prioritized patching hypotheses, not attribution:

• CVE-2026-59310 (VMware vCenter path traversal, KEV 2026-08-18): Mid-market manufacturers and utilities overwhelmingly virtualize on vSphere, and vCenter is a high-value pivot point. Internet-exposed or poorly segmented vCenter is a plausible entry for a group at this tier.
• CVE-2026-63077 (JetBrains TeamCity deserialization, KEV 2026-08-05): CI/CD servers in manufacturing and software-adjacent firms hold credentials, signing keys, and network access — attractive for both initial access and supply-chain-flavored lateral movement.
• CVE-2026-20316 (Cisco Secure FMC hard-coded password, KEV 2026-07-29) and CVE-2026-50751 (Check Point Security Gateway improper authentication, KEV 2026-06-08): Perimeter management planes remain the most common single entry point for mid-tier ransomware crews; both are confirmed ransomware-exploited.
• CVE-2026-48027 (Nx Console embedded malicious code, KEV 2026-05-27): A developer-tooling supply-chain vector; relevant where build machines are reachable from production segments.

If any of these products are in your estate and unpatched, remediate before finishing this briefing.

Detection Engineering

The following content targets the pre-detonation phase — the window where LAMASHTU-class operations are detectable and stoppable.

---
title: Edge and Management Plane Process Spawn — Possible CVE-2026-59310 / CVE-2026-63077 Follow-On
id: 9d4e2a71-3b6c-4f1a-9e55-lamash000001
status: experimental
description: Detects shells or script interpreters spawned by virtualization management, CI/CD, or firewall management services — consistent with post-exploitation after edge appliance compromise observed in mid-tier ransomware campaigns.
author: Security Arsenal Threat Intelligence
date: 2026/10/25
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\vpxd.exe'
      - '\java.exe'
      - '\tomcat9.exe'
      - '\httpd.exe'
      - '\nginx.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate vCenter or TeamCity maintenance scripts executed during change windows
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1059
---
title: Pre-Encryption Staging — Shadow Copy Deletion and Mass Compression
id: 9d4e2a71-3b6c-4f1a-9e55-lamash000002
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog deletion, recovery disablement, and mass archive creation — the standard pre-detonation sequence used by double-extortion ransomware crews including LAMASHTU-class actors.
author: Security Arsenal Threat Intelligence
date: 2026/10/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_shadow:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'wbadmin delete catalog'
      - 'bcdedit'
      - 'recoveryenabled no'
  selection_compress:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
  condition: selection_shadow or selection_compress
falsepositives:
  - Backup administrators running archival jobs; correlate with interactive logon source
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
---
title: Lateral Movement — PsExec Service Install, WMI Remote Execution, RDP Brute Force Signal
id: 9d4e2a71-3b6c-4f1a-9e55-lamash000003
status: experimental
description: Detects PsExec-style service installation, WMI remote process creation, and RDP logon failure bursts — lateral movement tooling commonly observed in ransomware intrusions ahead of domain-wide encryption.
author: Security Arsenal Threat Intelligence
date: 2026/10/25
logsource:
  product: windows
  service: system
detection:
  selection_psexec:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
    ServiceFileName|contains: 'ADMIN$'
  selection_wmi:
    EventID: 7045
    ServiceFileName|contains: 'wbem'
  condition: selection_psexec or selection_wmi
falsepositives:
  - Legitimate remote administration by IT; baseline service creation per host and alert on first-seen service names
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047

For RDP brute force specifically, use the KQL hunt below — a single-event Sigma rule cannot express the failure-burst correlation cleanly.

// LAMASHTU-class pre-ransomware hunt: staging + lateral movement correlation
// Microsoft Sentinel / Defender XDR — run over last 14 days
let Lookback = 14d;
let ShadowDelete =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("vssadmin delete shadows", "shadowcopy delete", "wbadmin delete catalog", "recoveryenabled no")
    | project StagingTime=TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName;
let MassCompress =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("7z.exe","7za.exe","rar.exe","winrar.exe")
    | where ProcessCommandLine has_any (" -p", " a ")
    | project CompressTime=TimeGenerated, DeviceName, AccountName, ProcessCommandLine;
let SuspiciousSvc =
    Event
    | where TimeGenerated > ago(Lookback)
    | where EventID == 7045
    | where EventData has_any ("PSEXESVC", "ADMIN$", "\\temp\\", "\\users\\public\\")
    | extend ServiceName = tostring(parse_xml(EventData).DataItem.EventData.Data.[0].["#text"])
    | project SvcTime=TimeGenerated, Computer, ServiceName;
let RdpBrute =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4625 and LogonType in (3, 10)
    | summarize FailCount=count(), DistinctUsers=dcount(TargetUserName) by Computer, IpAddress, bin(TimeGenerated, 15m)
    | where FailCount >= 10
    | project BruteWindow=TimeGenerated, Computer, IpAddress, FailCount, DistinctUsers;
ShadowDelete
| union MassCompress
| join kind=fullouter (SuspiciousSvc) on $left.DeviceName == $right.Computer
| join kind=fullouter (RdpBrute) on $left.DeviceName == $right.Computer
| sort by DeviceName asc

# Security Arsenal — LAMASHTU Rapid Triage & Hardening Script
# Run elevated on servers and any host flagged by the hunt queries above.
# Checks: recent scheduled tasks, shadow copies, RDP exposure, new local admins.

$Report = @()
$Cutoff = (Get-Date).AddDays(-7)

Write-Host "=== [1/4] Scheduled tasks created in last 7 days ===" -ForegroundColor Cyan
$tasks = Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; Author=$_.Author; LastRun=$info.LastRunTime }
}
# New-task detection via event log (more reliable than task metadata)
$newTasks = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TaskScheduler/Operational'; Id=106; StartTime=$Cutoff} -ErrorAction SilentlyContinue
if ($newTasks) { $newTasks | ForEach-Object { Write-Host $_.Message -ForegroundColor Yellow; $Report += "TASK: $($_.Message)" } }
else { Write-Host "No new task registrations in 7 days." }

Write-Host "=== [2/4] Volume Shadow Copies ===" -ForegroundColor Cyan
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "WARNING: No shadow copies present — possible anti-recovery action." -ForegroundColor Red; $Report += "VSS: NONE PRESENT" }
else { $shadows | Select-Object DeviceObject, InstallDate | Format-Table }

Write-Host "=== [3/4] RDP Exposure ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$rdpListen = (Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue) -ne $null
Write-Host "RDP Enabled: $rdpEnabled | NLA: $nla | Listening: $rdpListen"
if ($rdpEnabled -and -not $nla) { Write-Host "RISK: RDP without NLA — enable NLA immediately." -ForegroundColor Red; $Report += "RDP: NLA DISABLED" }
$recentRdpFail = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'Logon Type:\s+(3|10)' }
Write-Host "RDP/network logon failures (24h): $($recentRdpFail.Count)"
if ($recentRdpFail.Count -gt 50) { Write-Host "RISK: Brute-force pattern detected." -ForegroundColor Red; $Report += "RDP: BRUTE FORCE PATTERN" }

Write-Host "=== [4/4] Local Administrators ===" -ForegroundColor Cyan
$admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue
$admins | Select-Object Name, ObjectClass, PrincipalSource | Format-Table
$Report += "ADMINS: $($admins.Name -join '; ')"

$Report | Out-File "$env:TEMP\lamashtu_triage_$(Get-Date -Format yyyyMMdd_HHmm).txt"
Write-Host "Triage report written to $env:TEMP" -ForegroundColor Green

Incident Response Priorities

T-minus detection checklist (before encryption fires)

If you are in LAMASHTU's current target profile, sweep for these now:

1. Shadow copy / backup tampering: vssadmin, wbadmin, bcdedit execution by non-backup accounts; missing or reduced shadow copy counts.
2. Mass compression events: 7z/rar executions against file shares, especially password-protected archives (-p flag).
3. Unexpected outbound volume: sustained multi-GB uploads to unfamiliar cloud storage, MEGA-style hosts, or bare VPS IPs — exfil precedes extortion.
4. First-seen services: PSEXESVC or randomly named services spawning from ADMIN$ or user-writable paths.
5. Edge appliance anomalies: new local accounts or sessions on VPN concentrators, firewalls, vCenter, or TeamCity; config exports; log gaps on appliances (attackers frequently clear or disable edge logging).
6. Beaconing: periodic outbound connections at fixed intervals to low-reputation domains or IPs not seen elsewhere in the estate.

Assets this gang class prioritizes for exfiltration

Double-extortion crews of this tier consistently target: finance and payroll data, HR records, customer databases, contracts and legal documents, and engineering/IP files (drawings, formulations — especially relevant for the chemical and precision-manufacturing firms in this victim set). Inventory which hosts hold these and confirm egress alerting covers them.

Containment actions, ordered by urgency

1. Isolate, don't power off affected hosts (preserve memory for forensics) and segment suspect VLANs.
2. Disable compromised and anomalous accounts; force enterprise-wide credential reset if lateral movement is confirmed — include service accounts.
3. Block egress to attacker infrastructure at the perimeter; enable TLS-inspection alerting for known exfil tooling.
4. Reset VPN/edge appliance credentials and certificates if any edge compromise indicator exists; appliances are frequently re-entry points.
5. Protect backups: take backup infrastructure offline or immutable immediately; attackers target backup catalogs in the final pre-detonation phase.
6. Engage IR retainer and counsel early — leak-site publication means an extortion clock may already be running.

Hardening Recommendations

Immediate (24 hours)

• Patch or isolate the KEV perimeter set: Check Point Security Gateway (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), VMware vCenter (CVE-2026-59310), JetBrains TeamCity (CVE-2026-63077). If patching is not possible today, remove the management interfaces from any internet-reachable path.
• Enforce NLA + MFA on RDP, or disable external RDP entirely and move access behind a VPN/ZTNA broker.
• Block macro execution from internet-sourced Office documents (Mark-of-the-Web policy) and restrict script interpreters (wscript/cscript) for standard users.
• Alert on vssadmin/wbadmin/bcdedit execution outside backup maintenance windows — deploy the Sigma rules above to your SIEM now.
• Verify backup immutability and test one restore. Assume attackers will attempt catalog deletion.

Short-term (2 weeks)

• Segment management planes: vCenter, backup consoles, CI/CD servers, and firewall management must sit on dedicated, ACL-restricted segments unreachable from user VLANs.
• Deploy EDR with tamper protection to all servers, not just endpoints; mid-market manufacturers in this campaign profile commonly have server estates covered only by legacy AV.
• Implement egress filtering and DLP alerting on large outbound transfers from file servers — exfiltration is the leverage mechanism, and it is detectable.
• Establish dark web monitoring of gang leak sites so your organization learns of a listing before the extortion email arrives; time-to-response is the entire game with double extortion.
• Tabletop the leak-site scenario: decide in advance who handles extortion contact, regulator notification (GDPR timelines apply for FR/DE entities), and customer communication.

This briefing reflects threat-actor claims published on criminal infrastructure. It will be updated as corroboration changes. Named organizations may contact Security Arsenal at security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub