PIXELLEAKS Ransomware Group: 20 New Leak-Site Listings — Multi-Sector Claims Spanning APAC and North America

Classification: TLP:CLEAR | Publication Date: 2026-11-15 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

On 2026-11-15, ransomware.live monitoring infrastructure recorded 20 new victim listings on the PIXELLEAKS dark web leak site. The postings name organizations across eight sectors — Technology, Healthcare, Energy & Utilities, Financial Services, Professional Services, Education, Manufacturing, and Other — with a geographic concentration spanning Indonesia, China, the United States, Hong Kong, the Philippines, Switzerland, and Vietnam.

Fifteen of the 20 listings were independently corroborated by a second leak-site crawler, confirming that PIXELLEAKS published the claims. Corroboration confirms the posting exists — it does not confirm any breach occurred. Five listings appear on a single crawler source only and carry additional uncertainty.

The sector mix is notable. Financial services and healthcare organizations together represent a significant share of the listings, consistent with PIXELLEAKS's historical preference for data-rich, regulation-sensitive targets where the threat of disclosure creates maximum pressure to pay. The simultaneous appearance of APAC-headquartered firms and US-based professional services companies suggests either a broad initial-access broker supply chain or multiple parallel intrusion sets feeding the same leak operation.

Security teams at organizations matching the victim profile — mid-market firms in financial services, healthcare, technology, and energy, particularly those with APAC operations or subsidiaries — should treat this as an elevated threat window and review the detection engineering content in this briefing immediately.

Sourcing & Verification

This briefing is built entirely from threat-actor claims published on a criminal leak site and observed via ransomware.live monitoring. The following points apply without exception:

• 15 of 20 listings were independently observed by a second leak-site crawler (designated MULTI-SOURCE). 5 listings appear on a single crawler source only. Multi-source corroboration confirms the gang published the claim; it does not confirm that any intrusion, data theft, or encryption event occurred.
• Inclusion of an organization in this briefing reflects PIXELLEAKS's claim and nothing more. No named organization has confirmed an incident to Security Arsenal at time of publication.
• A named organization may dispute the listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is legally reportable. Neither silence nor denial settles the question.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — PIXELLEAKS

PIXELLEAKS is a ransomware and data-extortion operation that has maintained an active Tor-based leak site since emerging on the ransomware.live tracking index. The group operates a public-facing victim listing page with countdown timers, partial data teasers, and direct negotiation links — the standard double-extortion apparatus.

Aliases and Attribution: No confirmed aliases or rebrand lineage have been established for PIXELLEAKS as of this publication. The group does not appear to be a direct successor or rebrand of a previously tracked operation, though the leak-site infrastructure shares template characteristics with several mid-tier RaaS platforms. Attribution remains under analysis.

Operating Model: Available evidence is consistent with a Ransomware-as-a-Service (RaaS) or semi-closed affiliate model. The diversity of victim geography and sector in a single posting wave — 20 organizations across seven countries and eight sectors posted on the same day — is a strong indicator of multiple affiliate intrusion sets feeding a centralized leak operation. Pure closed-group operations typically show more concentrated targeting.

Ransom Demands: Specific ransom amounts for current victims have not been disclosed on the leak site at time of analysis. Mid-tier RaaS operations in this class typically demand between $500K and $5M USD depending on victim revenue, though this is an industry-wide pattern and not a confirmed PIXELLEAKS data point.

Initial Access Methods: Based on sector-level threat intelligence for groups in PIXELLEAKS's operating class, likely initial access vectors include:

• Exploitation of internet-facing VPN and firewall appliances
• Phishing campaigns delivering macro-enabled documents or malicious loaders
• RDP brute-force or credential stuffing against exposed remote access services
• Purchase of access from initial access brokers (IABs) — the broad geographic and sector spread is highly consistent with broker-sourced access

These are sector-level patterns, not confirmed vectors for any specific named victim.

Double Extortion: PIXELLEAKS operates a classic double-extortion model: exfiltrate data first, then encrypt, then threaten publication. The leak site features countdown timers and staged data release, indicating the group uses the threat of public disclosure as its primary pressure mechanism.

Dwell Time: Specific dwell-time metrics for PIXELLEAKS are not available. Industry-wide data for RaaS affiliates in this class suggests a median dwell time of 5–11 days from initial access to ransomware detonation, with exfiltration typically occurring 1–3 days before encryption. This is a general benchmark, not a PIXELLEAKS-specific measurement.

Current Campaign Analysis

Sector Targeting

The 20 organizations listed on 2026-11-15 span the following sectors:

Financial services and healthcare are the most heavily represented confirmed sectors. This is consistent with PIXELLEAKS's apparent preference for organizations that hold regulated data — PII, financial records, health information — where regulatory exposure amplifies the cost of public disclosure.

Geographic Concentration

The listings show a bimodal geographic pattern:

• APAC cluster: Indonesia (PT. Fiber Networks Indonesia), China (Huangshi Medical Laboratory), Hong Kong (BEAM Society, King International Investment Ltd), with country codes ID, CN, HK, PH, CH, and VN represented in the aggregate data
• North America cluster: United States (SPI Corp, Orion Communications Inc, Missouri Welding Institute, Koehler Financial Group Inc, Four Points Financial Solutions Inc., Eagle Fire Extinguisher Company)

The APAC concentration is notable. Many ransomware operations historically deprioritized APAC targets due to lower payment rates. A shift toward Indonesian, Chinese, and Hong Kong organizations may reflect evolving affiliate priorities, new initial access broker relationships in the region, or deliberate targeting of organizations with Western business relationships but APAC regulatory environments.

Victim Profile

The named organizations span a range from small professional services firms to publicly listed entities (King International Investment Ltd, HKEX: 00928). The majority appear to be small-to-midsize enterprises — organizations large enough to hold valuable data and carry cyber insurance, but typically below the threshold for dedicated 24/7 SOC operations. This is the classic RaaS affiliate sweet spot.

Revenue estimates vary widely by sector. Financial services firms in the listing set likely range from $5M–$100M+ in annual revenue. Healthcare and energy sector listings suggest organizations with critical operational dependencies where downtime carries outsized cost.

Posting Frequency and Escalation

All 20 listings carry a publication date of 2026-11-15. A same-day bulk posting of 20 victims is an aggressive cadence that suggests either:

1. A coordinated publication event designed to maximize media and defensive attention
2. A backlog of intrusions being published simultaneously after a negotiation window expired
3. Multiple affiliates submitting victims to the leak site concurrently

Bulk posting events of this size are often timed to coincide with the start of a business week to maximize pressure on named organizations. The fact that this occurred on a Saturday (2026-11-15 falls on a Saturday) may indicate automated publishing or a deliberate attempt to catch organizations during reduced weekend staffing.

CVE Exposure Assessment — Sector-Level Hypothesis

No evidence links any specific CVE to the initial access vector for any specific named victim in this dataset. However, several CVEs currently listed in CISA's Known Exploited Vulnerabilities catalog with confirmed ransomware use are relevant to the sectors PIXELLEAKS is targeting, and represent plausible exposure surfaces:

• CVE-2026-20316 (Cisco Secure FMC hard-coded password): Organizations running Cisco Secure Firewall Management Center — common in financial services and healthcare network environments — face risk of unauthenticated administrative access. This is a high-priority patch for any organization in the targeted sectors.
• CVE-2026-50751 (Check Point Security Gateway improper authentication): Check Point gateways are widely deployed in APAC enterprise environments. The improper authentication vulnerability in IKEv1 key exchange could provide initial network access without valid credentials. Given PIXELLEAKS's APAC targeting concentration, this CVE warrants immediate attention.
• CVE-2026-59310 (VMware vCenter path traversal): vCenter compromise provides lateral movement capability across the entire virtualized infrastructure — a force multiplier for ransomware deployment. Any organization in the victim profile running unpatched vCenter instances should treat this as critical.
• CVE-2026-63077 (JetBrains TeamCity deserialization): Technology companies and software development firms — represented in the PIXELLEAKS victim set — frequently run TeamCity CI/CD infrastructure. Deserialization vulnerabilities in build servers provide both initial access and supply-chain pivot opportunities.
• CVE-2026-48027 (Nx Console embedded malicious code): A supply-chain compromise vector targeting development environments. Relevant to the technology sector listings.

This is hypothesis-level analysis. No forensic evidence currently connects any of these CVEs to any PIXELLEAKS intrusion. They are listed because they represent actively exploited, ransomware-confirmed vulnerabilities in products commonly deployed in the targeted sectors.

Detection Engineering

Sigma Rules

The following Sigma rules target TTPs consistent with PIXELLEAKS's operating profile and the broader RaaS affiliate playbook: initial access via VPN/perimeter device exploitation, lateral movement via PsExec and WMI, and pre-encryption data staging.

---
title: Suspicious VPN/Firewall Management Interface Login from External IP
id: a1b2c3d4-0001-4e5f-8a9b-000000000001
status: experimental
description: Detects successful authentication to VPN concentrator or firewall management interfaces from non-corporate IP ranges. Relevant to initial access via CVE-2026-20316 (Cisco FMC) and CVE-2026-50751 (Check Point). Sector-level hypothesis for PIXELLEAKS initial access.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/11/15
logsource:
  category: authentication
  product: firewall
  definition: VPN and firewall management plane authentication events
detection:
  selection_success:
    - EventType: 'authentication_success'
    - Action: 'allow'
      Result: 'success'
  selection_mgmt_interface:
    - Interface|contains:
        - 'management'
        - 'admin'
        - 'mgmt'
    - DestinationPort:
        - 443
        - 8443
        - 10443
  filter_internal:
    SourceIP|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_success and selection_mgmt_interface and not filter_internal
falsepositives:
  - Legitimate remote administration from approved external IPs (SOC, MSP)
  - VPN gateway health-check endpoints
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1133
---
title: PsExec Service Creation and Remote Execution Chain
id: a1b2c3d4-0002-4e5f-8a9b-000000000002
status: experimental
description: Detects PsExec-style lateral movement via Windows service creation (Event ID 7045) with service binary paths commonly used by PsExec and its variants. RaaS affiliates frequently use PsExec for ransomware deployment and pre-encryption staging.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/15
logsource:
  product: windows
  service: system
  definition: Windows System event log — service installation events
detection:
  selection:
    EventID: 7045
  selection_psexec_indicators:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'RemCom'
      - 'csexec'
      - 'CSExecSvc'
    ImagePath|contains:
      - '\\ADMIN$\\'
      - '\\IPC$\\'
      - 'PSEXESVC'
      - '%SystemRoot%\\PSEXESVC'
  selection_suspicious_paths:
    ImagePath|contains:
      - '\\Users\\Public\\'
      - '\\Temp\\'
      - '\\AppData\\'
      - '\\ProgramData\\'
    ImagePath|endswith:
      - '.exe'
      - '.bat'
      - '.ps1'
  filter_legitimate:
    ServiceName|contains:
      - 'Microsoft'
      - 'Windows'
      - 'SCCM'
      - 'BigFix'
  condition: selection and (selection_psexec_indicators or selection_suspicious_paths) and not filter_legitimate
falsepositives:
  - Legitimate PsExec usage by IT administration
  - Software deployment tools that install temporary services
  - EDR/AV agent updates that create temporary services
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.execution
---
title: Data Staging and Mass Archive Creation Before Exfiltration
id: a1b2c3d4-0003-4e5f-8a9b-000000000003
status: experimental
description: Detects creation of large archive files (7z, RAR, ZIP) in unusual locations combined with execution of archiving tools from non-standard paths. Consistent with pre-exfiltration data staging observed in RaaS affiliate operations. Focus on WinRAR/7-Zip execution from writable user directories or via command-line with suspicious flags.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_archivers:
    Image|endswith:
      - '\\7z.exe'
      - '\\7za.exe'
      - '\\7zr.exe'
      - '\\rar.exe'
      - '\\winrar.exe'
      - '\\zip.exe'
      - '\\tar.exe'
      - '\\gzip.exe'
  selection_suspicious_path:
    Image|contains:
      - '\\Users\\Public\\'
      - '\\Temp\\'
      - '\\AppData\\Local\\Temp\\'
      - '\\ProgramData\\'
      - '\\Downloads\\'
  selection_cmdline_flags:
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' -v'
      - ' -r'
      - ' -mx'
      - ' -m0'
      - ' u '
      - ' -ibck'
  filter_known_software:
    Image|startswith:
      - 'C:\\Program Files\\7-Zip\\'
      - 'C:\\Program Files\\WinRAR\\'
      - 'C:\\Program Files (x86)\\7-Zip\\'
      - 'C:\\Program Files (x86)\\WinRAR\\'
  condition: selection_archivers and (selection_suspicious_path or selection_cmdline_flags) and not filter_known_software
falsepositives:
  - Legitimate user archiving activity from Downloads or Desktop
  - Automated backup scripts using 7-Zip or tar
  - Software packaging tools in development environments
level: medium
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1048

KQL Hunt Query — Microsoft Sentinel

The following KQL query hunts for a chained pattern of lateral movement indicators consistent with RaaS affiliate playbook: PsExec-style service installation, followed by WMI process execution on remote hosts, followed by mass file access patterns indicative of data staging. Run over a 7-day lookback and correlate by source host.

// PIXELLEAKS-affiliate lateral movement and staging hunt
// Correlates service creation, WMI remote execution, and mass file read on the same source host
// Lookback: 7 days | Author: Security Arsenal TI

let Lookback = 7d;

// Step 1: Hosts with PsExec-style service installations
let PsExecHosts =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 7045
    | where ServiceName has_any ("PSEXESVC", "PAExec", "RemCom", "csexec", "CSExecSvc")
       or ServiceFileName has_any ("ADMIN$", "PSEXESVC", "Users\\Public", "\\Temp\\")
    | extend PsExecTime = TimeGenerated
    | project PsExecTime, Computer, ServiceName, ServiceFileName, Account, IpAddress;

// Step 2: WMI remote process execution (Event ID 4688 with WmiPrvSE parent or wmiprvse.exe spawning cmd/powershell)
let WMIExec =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4688
    | where ParentProcessName has "WmiPrvSE.exe"
    | where NewProcessName has_any ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "mshta.exe", "wscript.exe")
    | extend WMITime = TimeGenerated
    | project WMITime, Computer, NewProcessName, CommandLine, Account, ParentProcessName;

// Step 3: Volume Shadow Copy deletion (vssadmin, wmic shadowcopy, diskshadow)
let ShadowCopyDelete =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4688
    | where CommandLine has_any ("vssadmin delete shadows", "vssadmin Delete Shadows",
                                  "wmic shadowcopy delete", "diskshadow",
                                  "bcdedit", "recoveryenabled no",
                                  "wbadmin delete catalog")
    | extend ShadowDeleteTime = TimeGenerated
    | project ShadowDeleteTime, Computer, CommandLine, Account;

// Step 4: Archive tool execution from non-standard paths
let ArchiveStaging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("7z.exe", "7za.exe", "rar.exe", "winrar.exe", "tar.exe")
    | where ProcessCommandLine has_any (" a ", " -p", " -r", " -v")
    | where FolderPath has_any ("\\Users\\Public\\", "\\Temp\\", "\\AppData\\", "\\ProgramData\\", "\\Downloads\\")
    | extend ArchiveTime = TimeGenerated
    | project ArchiveTime, DeviceName, FileName, ProcessCommandLine, FolderPath, AccountName;

// Correlate: hosts appearing in 2+ of the above indicator sets
let SuspiciousHosts =
    PsExecHosts
    | summarize PsExecCount = count() by Computer
    | join kind=inner (
        WMIExec
        | summarize WMICount = count() by Computer
    ) on Computer
    | project Computer, PsExecCount, WMICount;

// Enrich with shadow copy deletion and archive staging
SuspiciousHosts
| join kind=leftouter (
    ShadowCopyDelete
    | summarize ShadowDeleteCount = count(), ShadowDeleteCmds = make_set(CommandLine, 5) by Computer
) on Computer
| join kind=leftouter (
    ArchiveStaging
    | summarize ArchiveCount = count(), ArchiveCmds = make_set(ProcessCommandLine, 5) by Computer
) on Computer
| extend RiskScore =
    (PsExecCount * 3) +
    (WMICount * 2) +
    (iif(isnotnull(ShadowDeleteCount), ShadowDeleteCount * 5, 0)) +
    (iif(isnotnull(ArchiveCount), ArchiveCount * 4, 0))
| project Computer, PsExecCount, WMICount,
           ShadowDeleteCount, ShadowDeleteCmds,
           ArchiveCount, ArchiveCmds, RiskScore
| order by RiskScore desc
| take 50;

PowerShell Rapid-Response Detection Script

The following script performs three critical checks in a single pass: exposed RDP listeners, scheduled tasks created in the last 7 days (common persistence mechanism for RaaS affiliates), and Volume Shadow Copy status. Run on suspect hosts or deploy via your EDR remote shell capability.

<#
.SYNOPSIS
    PIXELLEAKS Rapid Triage — Pre-Ransomware Indicator Sweep
.DESCRIPTION
    Checks three high-value pre-encryption indicators on a Windows host:
    1. RDP exposure and non-standard RDP ports
    2. Scheduled tasks created in the last 7 days (persistence/staging)
    3. Volume Shadow Copy status and recent deletion events
    Run as Administrator. Output to console and optional CSV.
.AUTHOR
    Security Arsenal Threat Intelligence — 2026-11-15
#>

[CmdletBinding()]
param(
    [string]$OutputPath = "$env:TEMP\PixelLeaks_Triage_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv",
    [int]$LookbackDays = 7
)

$Results = @()
$CutoffDate = (Get-Date).AddDays(-$LookbackDays)

Write-Host "[+] PIXELLEAKS Rapid Triage — $(hostname) — $(Get-Date)" -ForegroundColor Cyan
Write-Host "[=] Lookback window: $LookbackDays days" -ForegroundColor Cyan

# ══════════════════════════════════════════════
# CHECK 1: RDP Exposure Assessment
# ══════════════════════════════════════════════
Write-Host "`n[1] RDP EXPOSURE CHECK" -ForegroundColor Yellow

$RDPPort = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue).PortNumber
$RDPStatus = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
$NLAStatus = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication

$RDPFinding = [PSCustomObject]@{
    Check     = 'RDP Configuration'
    RDPEnabled = if ($RDPStatus -eq 0) { 'YES — RISK' } else { 'No' }
    RDPPort   = $RDPPort
    NonStandardPort = if ($RDPPort -ne 3389) { 'YES — Review why' } else { 'No (default 3389)' }
    NLAEnabled = if ($NLAStatus -eq 1) { 'Yes' } else { 'NO — RISK' }
    Severity  = if ($RDPStatus -eq 0 -and $NLAStatus -ne 1) { 'HIGH' } elseif ($RDPStatus -eq 0) { 'MEDIUM' } else { 'INFO' }
}

Write-Host "    RDP Enabled: $($RDPFinding.RDPEnabled)"
Write-Host "    RDP Port: $($RDPFinding.RDPPort)"
Write-Host "    NLA Enabled: $($RDPFinding.NLAEnabled)"
Write-Host "    Severity: $($RDPFinding.Severity)"
$Results += $RDPFinding

# Check for active RDP sessions
$ActiveSessions = query session 2>$null | Where-Object { $_ -match 'rdp-tcp' -and $_ -match 'Active' }
if ($ActiveSessions) {
    Write-Host "    [!] ACTIVE RDP SESSIONS DETECTED:" -ForegroundColor Red
    $ActiveSessions | ForEach-Object { Write-Host "        $_" -ForegroundColor Red }
    $Results += [PSCustomObject]@{ Check = 'Active RDP Sessions'; Detail = ($ActiveSessions -join '; '); Severity = 'HIGH' }
}

# ══════════════════════════════════════════════
# CHECK 2: Recently Created Scheduled Tasks
# ══════════════════════════════════════════════
Write-Host "`n[2] SCHEDULED TASKS — Last $LookbackDays Days" -ForegroundColor Yellow

$RecentTasks = Get-ScheduledTask | Where-Object {
    $_.Date -and [datetime]$_.Date -gt $CutoffDate
} | ForEach-Object {
    $TaskInfo = $_ | Get-ScheduledTaskInfo
    [PSCustomObject]@{
        Check       = 'Scheduled Task (Recent)'
        TaskName    = $_.TaskName
        TaskPath    = $_.TaskPath
        Created     = $_.Date
        State       = $_.State
        LastRun     = $TaskInfo.LastRunTime
        Author      = $_.Author
        RunAsUser   = $_.Principal.UserId
        Actions     = ($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; '
        Severity    = if ($_.TaskPath -notmatch '\\Microsoft\\') { 'HIGH — Non-Microsoft path' } else { 'MEDIUM' }
    }
}

if ($RecentTasks) {
    $RecentTasks | ForEach-Object {
        Write-Host "    [!] $($_.TaskName) | Created: $($_.Created) | Path: $($_.TaskPath) | Runs: $($_.Actions)" -ForegroundColor Red
    }
    $Results += $RecentTasks
} else {
    Write-Host "    [✓] No new scheduled tasks in the last $LookbackDays days" -ForegroundColor Green
}

# Also check for tasks with suspicious actions regardless of creation date
$SuspiciousTasks = Get-ScheduledTask | Where-Object {
    $Actions = ($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; '
    $Actions -match 'powershell.*-enc|powershell.*-e |certutil.*-decode|bitsadmin.*transfer|mshta.*http|rundll32.*javascript|wscript.*\.vbs|\\Temp\\|\\AppData\\|\\ProgramData\\|\\Users\\Public\\'
} | ForEach-Object {
    [PSCustomObject]@{
        Check    = 'Scheduled Task (Suspicious Action)'
        TaskName = $_.TaskName
        TaskPath = $_.TaskPath
        Actions  = ($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; '
        Severity = 'HIGH'
    }
}

if ($SuspiciousTasks) {
    Write-Host "    [!] SUSPICIOUS TASK ACTIONS (any age):" -ForegroundColor Red
    $SuspiciousTasks | ForEach-Object { Write-Host "        $($_.TaskName): $($_.Actions)" -ForegroundColor Red }
    $Results += $SuspiciousTasks
}

# ══════════════════════════════════════════════
# CHECK 3: Volume Shadow Copy Status
# ══════════════════════════════════════════════
Write-Host "`n[3] VOLUME SHADOW COPY STATUS" -ForegroundColor Yellow

$ShadowCopies = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($ShadowCopies) {
    Write-Host "    [✓] Shadow copies present: $($ShadowCopies.Count)" -ForegroundColor Green
    $ShadowCopies | ForEach-Object {
        Write-Host "        Volume: $($_.VolumeName) | Created: $($_.InstallDate) | ID: $($_.ID)"
    }
    $Results += [PSCustomObject]@{ Check = 'Shadow Copies'; Count = $ShadowCopies.Count; Status = 'Present'; Severity = 'INFO' }
} else {
    Write-Host "    [!!] NO SHADOW COPIES FOUND — possible anti-forensics / pre-encryption staging" -ForegroundColor Red
    $Results += [PSCustomObject]@{ Check = 'Shadow Copies'; Count = 0; Status = 'MISSING — RISK'; Severity = 'CRITICAL' }
}

# Check VSS service status
$VSSService = Get-Service -Name VSS -ErrorAction SilentlyContinue
if ($VSSService) {
    Write-Host "    VSS Service Status: $($VSSService.Status) | StartType: $($VSSService.StartType)"
    if ($VSSService.StartType -eq 'Disabled') {
        Write-Host "    [!] VSS service is DISABLED — investigate" -ForegroundColor Red
        $Results += [PSCustomObject]@{ Check = 'VSS Service'; Status = 'Disabled'; Severity = 'HIGH' }
    }
}

# Check for recent vssadmin/shadowcopy deletion commands in PowerShell history
$PSHistoryPaths = Get-ChildItem "$env:USERPROFILE\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" -ErrorAction SilentlyContinue
if ($PSHistoryPaths) {
    $HistoryContent = Get-Content $PSHistoryPaths.FullName -ErrorAction SilentlyContinue
    $ShadowDeleteHistory = $HistoryContent | Where-Object { $_ -match 'vssadmin.*delete|shadowcopy.*delete|diskshadow|wbadmin.*delete.*catalog|bcdedit.*recoveryenabled' }
    if ($ShadowDeleteHistory) {
        Write-Host "    [!!] SHADOW COPY DELETION COMMANDS IN PS HISTORY:" -ForegroundColor Red
        $ShadowDeleteHistory | ForEach-Object { Write-Host "        $_" -ForegroundColor Red }
        $Results += [PSCustomObject]@{ Check = 'PS History — Shadow Delete'; Detail = ($ShadowDeleteHistory -join '; '); Severity = 'CRITICAL' }
    }
}

# ══════════════════════════════════════════════
# CHECK 4: Network listeners on common ransomware C2 / exfil ports
# ══════════════════════════════════════════════
Write-Host "`n[4] NETWORK LISTENER CHECK" -ForegroundColor Yellow

$SuspiciousListeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object {
    $_.RemoteAddress -eq '0.0.0.0' -and $_.LocalPort -notin @(135, 139, 445, 3389, 5985, 5986, 80, 443, 53, 88, 389, 636, 464, 3268, 3269, 9389, 5722, 25, 587, 993, 995, 143, 110, 21, 22, 8080, 8443)
} | ForEach-Object {
    $OwningProcess = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        Check       = 'Network Listener'
        LocalPort   = $_.LocalPort
        ProcessName = $OwningProcess.ProcessName
        ProcessPath = $OwningProcess.Path
        PID         = $_.OwningProcess
        Severity    = 'MEDIUM — Verify legitimacy'
    }
}

if ($SuspiciousListeners) {
    $SuspiciousListeners | Sort-Object LocalPort -Unique | ForEach-Object {
        Write-Host "    [?] Port $($_.LocalPort) — $($_.ProcessName) ($($_.ProcessPath))" -ForegroundColor Yellow
    }
    $Results += $SuspiciousListeners
} else {
    Write-Host "    [✓] No unusual listeners detected" -ForegroundColor Green
}

# ══════════════════════════════════════════════
# OUTPUT
# ══════════════════════════════════════════════
Write-Host "`n[+] Exporting results to: $OutputPath" -ForegroundColor Cyan
$Results | Export-Csv -Path $OutputPath -NoTypeInformation -Force

$CriticalCount = ($Results | Where-Object { $_.Severity -match 'CRITICAL' }).Count
$HighCount = ($Results | Where-Object { $_.Severity -match 'HIGH' }).Count

Write-Host "`n═══════════════════════════════════════" -ForegroundColor Cyan
Write-Host "  TRIAGE SUMMARY" -ForegroundColor Cyan
Write-Host "  CRITICAL findings: $CriticalCount" -ForegroundColor $(if ($CriticalCount -gt 0) { 'Red' } else { 'Green' })
Write-Host "  HIGH findings:     $HighCount" -ForegroundColor $(if ($HighCount -gt 0) { 'Red' } else { 'Green' })
Write-Host "  Total findings:    $($Results.Count)"
Write-Host "  Report saved to:   $OutputPath"
Write-Host "═══════════════════════════════════════" -ForegroundColor Cyan

if ($CriticalCount -gt 0) {
    Write-Host "`n[!] CRITICAL findings detected — escalate to IR immediately" -ForegroundColor Red
    Write-Host "    Contact: security@securityarsenal.com" -ForegroundColor Red
}

Incident Response Priorities

T-Minus Detection Checklist — Before Encryption Fires

The window between initial access and ransomware detonation is typically 5–11 days for RaaS affiliate operations. The following indicators, if detected, suggest an active pre-encryption intrusion and demand immediate escalation:

Immediate escalation triggers (any one of these):

Critical Assets for Exfiltration Targeting

Based on the sectors PIXELLEAKS is listing in this campaign, the following asset classes are most likely targeted for exfiltration before encryption:

• Financial services listings: Client PII, account records, financial statements, wire transfer records, regulatory filings
• Healthcare listings: Patient records (PHI), laboratory results, insurance claims data, medical imaging archives
• Technology listings: Source code repositories, customer databases, API keys and credentials, internal documentation
• Energy & utilities listings: SCADA/OT network diagrams, operational data, engineering documents, customer billing records
• All sectors: Email archives (executive mailboxes especially), Active Directory databases (NTDS.dit), backup catalogs, cyber insurance policy documents

Containment Actions — Ordered by Urgency

If pre-encryption indicators are confirmed on any host:

1. Isolate the affected host(s) from the network immediately. Use EDR network isolation if available. Do NOT power off — memory forensics may be critical.
2. Disable all VPN and remote access for the affected user accounts. Force credential resets. Revoke all active sessions and tokens.
3. Block outbound traffic to known ransomware C2 and exfiltration endpoints at the perimeter. If exfiltration is in progress, block the destination IP/domain immediately.
4. Preserve evidence. Capture memory dumps, collect Windows event logs, snapshot affected VMs before any remediation.
5. Check backup integrity. Verify that backup systems are isolated and have not been accessed by the threat actor. RaaS affiliates routinely target backup infrastructure before detonation.
6. Activate your incident response plan. Engage your IR retainer or MDR provider. If you do not have one, contact Security Arsenal at security@securityarsenal.com.
7. Do NOT pay the ransom without legal counsel. Payment may violate sanctions regulations depending on the threat actor's jurisdiction and does not guarantee data deletion.

Hardening Recommendations

Immediate (24 Hours)

These controls address the most likely initial access and lateral movement vectors based on PIXELLEAKS's operating profile and the KEV-listed vulnerabilities relevant to targeted sectors:

1. Patch or mitigate CISA KEV vulnerabilities in perimeter and management infrastructure. Priority order for the sectors being targeted:
   • CVE-2026-20316 (Cisco Secure FMC) — patch or restrict management interface access to authorized IPs only
   • CVE-2026-50751 (Check Point Security Gateway) — patch or disable IKEv1 if not required
   • CVE-2026-59310 (VMware vCenter) — patch immediately; vCenter compromise enables full-infrastructure lateral movement
   • CVE-2026-63077 (JetBrains TeamCity) — patch and audit build server access logs
   • CVE-2026-48027 (Nx Console) — audit installed versions and remove compromised packages
2. Disable RDP on all internet-facing systems. If RDP is required, place it behind VPN with MFA. Verify no systems respond on port 3389 from external networks.
3. Enforce MFA on all remote access services — VPN, RDP gateways, webmail, cloud admin portals. Credential stuffing against non-MFA services is the most common initial access vector for RaaS affiliates.
4. Enable Windows LSA Protection and Credential Guard on all endpoints to complicate credential theft for lateral movement.
5. Block PsExec and remote service creation for non-administrative accounts via AppLocker or Windows Defender Application Control (WDAC) policies.
6. Verify backup isolation. Confirm backups are offline, air-gapped, or immutable. Test restoration procedures.
7. Enable Volume Shadow Copy deletion alerting in your SIEM/EDR. Any vssadmin delete shadows execution should trigger an immediate page to the SOC.
8. Deploy the Sigma rules and KQL queries from this briefing to your detection stack.

Short-Term (2 Weeks)

1. Implement network segmentation between user workstations, servers, and critical infrastructure. RaaS affiliates rely on flat networks for lateral movement. Micro-segmentation between VLANs with east-west traffic inspection dramatically reduces blast radius.
2. Deploy endpoint detection and response (EDR) with ransomware-specific behavioral analytics on all endpoints and servers. Ensure tamper protection is enabled.
3. Implement application allowlisting on servers and high-value workstations. Block execution from user-writable directories (%TEMP%, %APPDATA%, %PUBLIC%).
4. Establish Data Loss Prevention (DLP) policies with alerting on bulk data transfers. RaaS affiliates exfiltrate before encrypting — DLP can catch the theft before the damage.
5. Conduct a phishing simulation and targeted awareness training for all staff, with emphasis on macro-enabled documents and credential harvesting pages. Phishing remains a top initial access vector.
6. Review and test your incident response plan. Ensure it includes specific ransomware playbooks, external counsel contact, cyber insurance notification procedures, and regulatory disclosure decision trees.
7. Establish dark web monitoring for your organization's name, domains, and executive identities. Early warning of leak-site listing provides critical response time before public disclosure.

Conclusion

PIXELLEAKS's 20-listing publication event on 2026-11-15 represents a significant escalation in this group's visible activity. The sector and geographic diversity of the listings — spanning APAC and North America, financial services and healthcare, small professional firms and publicly listed companies — is consistent with a mature RaaS operation sourcing access from multiple intrusion sets or brokers.

Every organization named in this briefing is the subject of an unverified criminal claim. Neither Security Arsenal nor the corroborating crawler data confirms that any breach occurred. However, the pattern of targeting is real, and organizations matching the victim profile — mid-market firms in financial services, healthcare, technology, and energy, particularly those with APAC operations — should treat this as an actionable threat signal.

The detection engineering content in this briefing — Sigma rules, KQL queries, and the rapid triage script — is designed to catch the pre-encryption phase of a ransomware intrusion. The window between initial access and detonation is where defenders have the most leverage. Use it.

Security Arsenal will continue monitoring PIXELLEAKS's leak site and will publish updates as new information becomes available. Named organizations are encouraged to contact security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response

Managed SOC & MDR Services

AlertMonitor Threat Detection

From The Dark Side Intel Hub