SHIBA Ransomware Gang: 4 New Dark Web Listings — Agriculture, Healthcare, and Professional Services Targeting Analysis

Classification: TLP:CLEAR | Publication Date: 2026-10-30 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

The SHIBA ransomware operation has listed four organizations on its dark web leak site within the past 48 hours, according to monitoring data from ransomware.live. The group claims to have compromised IT Foods Industries (Agriculture and Food Production), Friendly Senior Living (Healthcare), Morgan White Group (Professional Services), and Antwerp House Dentistry (Healthcare). All four listings were published on 2026-10-29.

Geographic concentration is notable: while three listings lack country attribution in our data, the single multi-source-confirmed listing (Antwerp House Dentistry) is located in the United Kingdom. This suggests potential UK-focused targeting, though the sample size is insufficient to confirm this as a deliberate campaign focus.

Sector analysis reveals a concerning pattern: two of the four claimed victims operate in Healthcare, a sector that ransomware groups increasingly target due to operational pressure to pay ransoms quickly and regulatory sensitivity around patient data exposure. The Agriculture and Food Production listing is consistent with broader ransomware ecosystem trends toward targeting food supply chain entities, particularly following high-profile incidents in that sector.

Important caveat: These are unverified claims by a criminal threat actor. No tier in our data confirms that any breach occurred. Organizations named in this briefing may dispute these listings, and Security Arsenal makes no assertion that any listed organization has suffered a security incident.

Sourcing & Verification

Of the four SHIBA listings analyzed in this briefing, one (Antwerp House Dentistry) was independently observed by a second leak-site crawler, meaning two separate monitoring infrastructures confirmed the posting exists on SHIBA's dark web site. The remaining three listings appear only on ransomware.live and lack second-crawler corroboration.

It is critical to understand what multi-source confirmation means: it confirms that the threat actor made the claim, not that a breach occurred. A leak-site posting is an accusation by a criminal organization. It may be accurate, exaggerated, fabricated to pressure victims, or part of a broader social engineering campaign.

Inclusion in this briefing reflects the threat actor's claim and is not confirmation of a breach. Named organizations may dispute these listings, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction, sector, and regulatory framework; not every security incident is publicly reportable, so neither silence nor denial settles the question definitively.

Security Arsenal will publish corrections if any named organization provides evidence that a listing is fraudulent. We welcome contact from any organization named in this briefing at security@securityarsenal.com.

Threat Actor Profile — SHIBA

Known Aliases and Attribution

SHIBA operates under limited public attribution. The group has not been definitively linked to known ransomware-as-a-service (RaaS) brands or previously tracked threat actors in open-source intelligence reporting. The absence of robust alias mapping may indicate either a newer operation or a deliberate effort to avoid pattern-matching by security researchers and law enforcement.

Operational Model

Current intelligence suggests SHIBA operates as either a closed ransomware group or a small, invitation-only RaaS with limited affiliate recruitment. The group does not maintain the high-volume posting cadence associated with major RaaS platforms like LockBit, BlackCat, or Play, which supports the closed-group hypothesis.

Ransom Demands and Extortion Tactics

Specific ransom demand ranges for SHIBA are not well-documented in open reporting. However, the group's adoption of double extortion—threatening to publish stolen data if ransom is not paid—aligns with industry-standard ransomware economics. Groups targeting Healthcare and Professional Services typically demand ransoms scaled to perceived ability to pay, often ranging from low six figures for small organizations to seven figures for larger enterprises.

Initial Access Methods

SHIBA's precise initial access vectors are not comprehensively documented. However, based on sector targeting (Healthcare, Agriculture, Professional Services) and common ransomware TTPs, likely access methods include:

• Phishing with malicious attachments or links: Remains the dominant initial access vector across ransomware operations, particularly for sectors with large non-technical user bases like Healthcare.
• Exploitation of internet-facing remote access services: VPN concentrators, RDP gateways, and remote desktop infrastructure are high-value targets for groups seeking initial footholds.
• Credential stuffing and brute-force attacks: Organizations with weak MFA enforcement on remote access portals are frequent ransomware victims.
• Supply chain compromise: While less common, groups have increasingly targeted managed service providers (MSPs) and software supply chains to gain access to downstream customers.

Dwell Time and Encryption Timeline

Average dwell time (time from initial access to ransomware detonation) varies widely across ransomware operations but typically ranges from 3 to 14 days. Groups conducting manual, hands-on-keyboard operations often spend several days conducting reconnaissance, escalating privileges, moving laterally, and staging data for exfiltration before triggering encryption.

SHIBA's specific dwell time is not publicly documented, but organizations should assume a multi-day window between initial compromise and ransomware deployment during which detection and containment are possible.

Current Campaign Analysis

Sector Targeting

SHIBA's recent victim claims span three sectors:

1. Healthcare (2 of 4 listings): Friendly Senior Living and Antwerp House Dentistry. Healthcare remains one of the most frequently targeted sectors due to operational criticality, regulatory pressure, and often-fragile IT security postures. Senior living facilities and dental practices are typically small-to-medium enterprises (SMEs) with limited dedicated security staff, making them attractive targets.

2. Agriculture and Food Production (1 of 4 listings): IT Foods Industries. Ransomware groups have increasingly targeted food and agriculture entities following high-profile incidents that demonstrated the sector's vulnerability and willingness to pay to avoid operational disruption.

3. Professional Services (1 of 4 listings): Morgan White Group. Professional services firms (legal, accounting, consulting) are attractive targets due to the sensitive client data they hold and potential for reputational damage if that data is exposed.

Geographic Concentration

Only one listing (Antwerp House Dentistry) includes confirmed country attribution: United Kingdom. The absence of country data for the other three listings prevents definitive geographic analysis. However, if all four organizations are UK-based, this could indicate a regional campaign focus. Security teams at UK-based organizations in the targeted sectors should treat this as a potential elevation in threat level.

Victim Profile

Based on sector norms:

• IT Foods Industries: Food production companies range from small regional processors to multinational corporations. Without revenue data, we cannot estimate size, but ransomware groups typically target mid-market firms (50-500 employees, $10M-$500M revenue) that have sufficient resources to pay but lack enterprise-grade security.

• Friendly Senior Living: Senior living facilities are typically SMEs with 50-200 employees and annual revenues in the $5M-$50M range. These organizations often run lean IT operations and may lack 24/7 security monitoring.

• Morgan White Group: Professional services firms vary widely in size. The name suggests a boutique or mid-sized consultancy, likely 20-100 employees.

• Antwerp House Dentistry: Dental practices are small businesses, typically 10-50 employees with revenues under $10M. They frequently rely on outsourced IT support and may have limited security maturity.

Posting Frequency and Escalation Patterns

SHIBA posted four victim claims in a single day (2026-10-29). This burst activity could indicate:

• Completion of a campaign phase with multiple victims ready for extortion simultaneously
• An attempt to generate publicity and pressure by flooding the leak site
• A shift toward more aggressive public extortion tactics

Without historical baseline data for SHIBA's posting cadence, we cannot determine whether this represents an escalation. Continued monitoring will assess whether this tempo is sustained.

CVE Exposure and Initial Access Hypotheses

The following CVEs are actively exploited by ransomware groups according to CISA's Known Exploited Vulnerabilities (KEV) catalog. We have no evidence linking these CVEs to the specific SHIBA victim claims above. However, they represent sector-level exposure that ransomware groups—including potentially SHIBA—are known to exploit for initial access:

• CVE-2026-59310 (VMware vCenter Path Traversal): Virtualization infrastructure is a high-value target. Compromise of vCenter can provide access to multiple virtual machines and underlying data stores, enabling mass encryption. Healthcare and Professional Services organizations frequently run VMware environments.

• CVE-2026-63077 (JetBrains TeamCity Deserialization): CI/CD pipeline compromise can provide access to source code, credentials, and downstream production systems. Professional Services firms and software-adjacent organizations are at elevated risk.

• CVE-2026-20316 (Cisco Secure FMC Hard-coded Password): Network security appliance compromise can provide a foothold for lateral movement. Organizations with unpatched Cisco FMC instances exposed to the internet are at critical risk.

• CVE-2026-50751 (Check Point Security Gateway Improper Authentication): VPN and firewall compromise is a classic ransomware initial access vector. All sectors are at risk if internet-facing Check Point gateways are unpatched.

• CVE-2026-48027 (Nx Console Embedded Malicious Code): Supply chain compromise via malicious development tools. Organizations using Nx Console should immediately verify they are running a clean version.

Actionable guidance: Organizations in Healthcare, Agriculture, and Professional Services should immediately audit their exposure to these CVEs and prioritize patching based on internet-facing exposure and exploit availability.

Detection Engineering

The following detection content targets TTPs commonly observed in ransomware operations, with specific focus on the initial access and lateral movement techniques likely employed by groups like SHIBA.

Sigma Rules

---
title: Suspicious RDP Logon from External IP
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
description: Detects successful RDP logons from external IP addresses, a common initial access vector for ransomware groups exploiting exposed RDP services
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/30
logsource:
  product: windows
  service: security
  category: logon
detection:
  selection:
    EventID: 4624
    LogonType: 10
  filter_internal:
    IpAddress|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate remote access via VPN or jump boxes
  - Third-party MSP access
level: high
tags:
  - attack.initial_access
  - attack.t1133
---
title: PsExec Service Creation and Execution
id: 7e6d5c4b-3a2f-1e0d-9c8b-7a6f5e4d3c2b
description: Detects PsExec-style service creation for lateral movement, a technique used by ransomware operators to execute payloads on remote systems
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/30
logsource:
  product: windows
  service: system
  category: service_installation
detection:
  selection:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'psexec'
    ImagePath|contains:
      - '\\ADMIN$\\'
      - '\\IPC$\\'
  condition: selection
falsepositives:
  - Legitimate administrative tools used by IT staff
  - System management software
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
---
title: Volume Shadow Copy Deletion via vssadmin or wmic
id: 6f5e4d3c-2b1a-0f9e-8d7c-6b5a4f3e2d1c
description: Detects deletion of Volume Shadow Copies, a common pre-encryption anti-forensics technique used by ransomware to prevent recovery
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/30
logsource:
  product: windows
  service: security
  category: process_creation
detection:
  selection:
    EventID: 4688
    NewProcessName|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
  condition: selection
falsepositives:
  - Legitimate backup or storage management operations
  - System administrators performing maintenance
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion

KQL Hunt Query (Microsoft Sentinel)

// Hunt for pre-ransomware staging indicators: mass file access, suspicious archive creation, and data exfiltration patterns
// Focus: Detect data staging behavior before encryption deployment
let TimeRange = 7d;
let SuspiciousExtensions = dynamic([".7z", ".rar", ".zip", ".tar.gz"]);
let HighRiskProcesses = dynamic(["7z.exe", "rar.exe", "winrar.exe", "tar.exe", "makecab.exe"]);
let RansomwareKeywords = dynamic(["exfil", "staging", "backup", "archive"]);
union
(DeviceFileEvents
| where TimeGenerated > ago(TimeRange)
| where FileName has_any (SuspiciousExtensions)
| where InitiatingProcessFileName in~ (HighRiskProcesses)
| summarize FileCount = count(), Files = make_set(FileName, 100) by DeviceName, InitiatingProcessFileName, FolderPath, bin(TimeGenerated, 1h)
| where FileCount > 50
| extend AlertType = "Mass Archive Creation"),
(DeviceNetworkEvents
| where TimeGenerated > ago(TimeRange)
| where RemotePort in (21, 22, 443, 8080, 8443)
| where InitiatingProcessFileName in~ (HighRiskProcesses) or InitiatingProcessCommandLine has_any (RansomwareKeywords)
| summarize ConnectionCount = count(), RemoteIPs = make_set(RemoteIP, 50) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where ConnectionCount > 10
| extend AlertType = "Suspicious Outbound Transfer"),
(DeviceProcessEvents
| where TimeGenerated > ago(TimeRange)
| where ProcessCommandLine has_any ("vssadmin delete", "wmic shadowcopy delete", "bcdedit /set")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
| extend AlertType = "Shadow Copy Deletion")
| project TimeGenerated, DeviceName, AlertType, FileCount, ConnectionCount, Files, RemoteIPs, InitiatingProcessFileName, FolderPath, ProcessCommandLine
| order by TimeGenerated desc

PowerShell Rapid-Response Detection Script

# SHIBA Ransomware Rapid Triage Script
# Purpose: Identify indicators of ransomware staging and lateral movement
# Run on suspected compromised systems or as part of proactive threat hunting
# Requires: Administrative privileges

Write-Host "[+] SHIBA Ransomware Rapid Triage Script" -ForegroundColor Cyan
Write-Host "[+] Scanning for common ransomware indicators...`n" -ForegroundColor Cyan

# 1. Check for recently created scheduled tasks (persistence mechanism)
Write-Host "[*] Checking for scheduled tasks created in the last 7 days..." -ForegroundColor Yellow
$RecentTasks = Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | Select-Object TaskName, TaskPath, Date, Author
if ($RecentTasks) {
    Write-Host "[!] ALERT: Found $($RecentTasks.Count) recently created scheduled tasks:" -ForegroundColor Red
    $RecentTasks | Format-Table -AutoSize
} else {
    Write-Host "[+] No suspicious scheduled tasks found." -ForegroundColor Green
}

# 2. Check for Volume Shadow Copy status
Write-Host "`n[*] Checking Volume Shadow Copy status..." -ForegroundColor Yellow
$VSSStatus = vssadmin list shadows 2>&1
if ($VSSStatus -match "No shadow copies found" -or $VSSStatus -match "Error") {
    Write-Host "[!] ALERT: Volume Shadow Copies may have been deleted!" -ForegroundColor Red
    Write-Host "[!] This is a common pre-encryption ransomware technique." -ForegroundColor Red
} else {
    Write-Host "[+] Volume Shadow Copies exist." -ForegroundColor Green
}

# 3. Check for exposed RDP and recent logons
Write-Host "`n[*] Checking for recent RDP logons..." -ForegroundColor Yellow
$RDPEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; LogonType=10} -MaxEvents 20 -ErrorAction SilentlyContinue | Select-Object TimeCreated, @{Name='SourceIP';Expression={$_.Properties[18].Value}}, @{Name='Username';Expression={$_.Properties[5].Value}}
if ($RDPEvents) {
    Write-Host "[*] Recent RDP logons detected (last 20):" -ForegroundColor Yellow
    $RDPEvents | Format-Table -AutoSize
    $ExternalRDP = $RDPEvents | Where-Object {$_.SourceIP -notmatch "^(10\.|172\.16\.|192\.168\.|::1|127\.)"}
    if ($ExternalRDP) {
        Write-Host "[!] ALERT: Found $($ExternalRDP.Count) RDP logons from external IPs!" -ForegroundColor Red
    }
} else {
    Write-Host "[+] No recent RDP logons detected." -ForegroundColor Green
}

# 4. Check for suspicious processes
Write-Host "`n[*] Checking for suspicious running processes..." -ForegroundColor Yellow
$SuspiciousProcesses = @("psexec", "psexesvc", "7z", "rar", "winrar", "vssadmin", "wmic")
$RunningSuspicious = Get-Process | Where-Object {$SuspiciousProcesses -contains $_.ProcessName.ToLower()}
if ($RunningSuspicious) {
    Write-Host "[!] ALERT: Suspicious processes detected:" -ForegroundColor Red
    $RunningSuspicious | Select-Object ProcessName, Id, Path, StartTime | Format-Table -AutoSize
} else {
    Write-Host "[+] No suspicious processes detected." -ForegroundColor Green
}

# 5. Check for recently modified files in critical directories
Write-Host "`n[*] Checking for recently modified files in ProgramData and Temp..." -ForegroundColor Yellow
$RecentFiles = Get-ChildItem -Path "C:\ProgramData", "C:\Windows\Temp" -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-3)} | Select-Object FullName, LastWriteTime, Length | Sort-Object LastWriteTime -Descending | Select-Object -First 20
if ($RecentFiles) {
    Write-Host "[*] Recently modified files (last 3 days, top 20):" -ForegroundColor Yellow
    $RecentFiles | Format-Table -AutoSize
}

# 6. Check Windows Defender status
Write-Host "`n[*] Checking Windows Defender status..." -ForegroundColor Yellow
$DefenderStatus = Get-MpComputerStatus -ErrorAction SilentlyContinue
if ($DefenderStatus) {
    if (-not $DefenderStatus.RealTimeProtectionEnabled) {
        Write-Host "[!] ALERT: Windows Defender Real-Time Protection is DISABLED!" -ForegroundColor Red
    }
    if (-not $DefenderStatus.AntivirusEnabled) {
        Write-Host "[!] ALERT: Windows Defender Antivirus is DISABLED!" -ForegroundColor Red
    }
    if ($DefenderStatus.RealTimeProtectionEnabled -and $DefenderStatus.AntivirusEnabled) {
        Write-Host "[+] Windows Defender is active." -ForegroundColor Green
    }
} else {
    Write-Host "[!] Unable to query Windows Defender status (may be disabled or third-party AV in use)." -ForegroundColor Yellow
}

# Summary
Write-Host "`n[+] Triage complete. Review any ALERT items above." -ForegroundColor Cyan
Write-Host "[+] If ransomware indicators are present, isolate this system immediately and activate incident response procedures.`n" -ForegroundColor Cyan

Incident Response Priorities

If your organization suspects it may be targeted by SHIBA or discovers evidence of ransomware staging, the following priorities apply.

T-Minus Detection Checklist (Pre-Encryption Indicators)

Ransomware deployment is rarely instantaneous. In the hours to days before encryption, look for:

1. Credential dumping and privilege escalation:

   • LSASS memory access by non-system processes
   • Suspicious use of Mimikatz, Procdump, or comsvcs.dll for credential extraction
   • Addition of unauthorized accounts to Domain Admins or local Administrators groups

2. Reconnaissance and lateral movement:

   • Network scanning from workstations (nmap, Advanced IP Scanner, Masscan)
   • Remote service creation via PsExec, WMI, or WinRM
   • Unusual SMB or RDP connections between internal systems

3. Data staging and exfiltration:

   • Mass file access or copying to staging directories (e.g., C:\ProgramData, user temp folders)
   • Creation of large archive files (.7z, .rar, .zip)
   • Outbound network connections to cloud storage (MEGA, Dropbox, Google Drive) or anonymous file-sharing services from servers
   • Use of Rclone, FileZilla, or WinSCP by non-IT personnel

4. Anti-forensics and defense evasion:

   • Deletion of Volume Shadow Copies (vssadmin, wmic)
   • Clearing of Windows Event Logs (wevtutil, Clear-EventLog)
   • Disabling of Windows Defender or EDR agents
   • Modification of boot configuration (bcdedit)

Critical Assets Targeted for Exfiltration

Based on ransomware group behavior across sectors, prioritize protection of:

• Healthcare: Patient records (PHI), financial data, employee HR files, medical imaging archives, backup repositories
• Professional Services: Client files, case documents, financial records, contracts, email archives
• Agriculture/Food Production: Supply chain data, customer contracts, proprietary formulations or processes, financial systems
• All sectors: Domain controller NTDS.dit database, backup catalogues, password vaults, financial/accounting databases

Containment Actions by Urgency

Immediate (0-15 minutes):

1. Isolate affected systems from the network (disable switch ports, not just OS-level network disconnection)
2. Disable compromised user accounts and service accounts
3. Block identified command-and-control (C2) domains and IPs at the firewall
4. Preserve forensic evidence (memory dumps, disk images) before rebooting

Short-term (15 minutes - 1 hour): 5. Identify patient zero (initial access vector) 6. Audit privileged account usage and reset all administrative credentials 7. Verify backup integrity and isolate backup infrastructure 8. Activate incident response retainer and notify cyber insurance provider

Medium-term (1-24 hours): 9. Conduct enterprise-wide threat hunt for additional persistence mechanisms 10. Assess data exfiltration scope (network logs, proxy logs, DLP alerts) 11. Prepare regulatory notification assessments (GDPR, HIPAA, state breach laws) 12. Engage external forensics and legal counsel

Hardening Recommendations

Immediate (24 Hours)

1. Patch internet-facing vulnerabilities: Prioritize CVE-2026-59310 (VMware vCenter), CVE-2026-20316 (Cisco FMC), and CVE-2026-50751 (Check Point) if applicable to your environment. These are actively exploited for ransomware initial access.

2. Enforce MFA on all remote access: VPN, RDP, webmail, and cloud services must require multi-factor authentication. Ransomware groups consistently exploit single-factor authentication.

3. Disable RDP if not required: If RDP is not business-critical, disable it. If required, restrict to VPN-only access, enforce Network Level Authentication (NLA), and implement account lockout policies.

4. Enable advanced audit logging: Ensure Windows Event Logging captures process creation (Event ID 4688), PowerShell script block logging (Event ID 4104), and network connections (Sysmon Event ID 3, if deployed).

5. Verify backup integrity: Confirm that backups are offline or immutable, test restoration procedures, and ensure backup credentials are separate from domain credentials.

6. Block common ransomware tools at the perimeter: Deny inbound/outbound traffic to known C2 infrastructure, block PsExec and administrative shares from workstations, and restrict SMB traffic between user subnets.

Short-Term (2 Weeks)

1. Implement network segmentation: Separate user workstations from servers, isolate critical infrastructure (backup servers, domain controllers), and restrict lateral movement paths. Microsegmentation reduces ransomware blast radius.

2. Deploy Endpoint Detection and Response (EDR): EDR platforms provide behavioral detection of ransomware TTPs (shadow copy deletion, mass file encryption, credential dumping) that signature-based antivirus misses.

3. Establish a Security Operations Center (SOC) or engage Managed Detection and Response (MDR): 24/7 monitoring is essential for detecting pre-encryption staging. Ransomware groups often operate during off-hours when IT staff are unavailable.

4. Conduct phishing simulation and user awareness training: Phishing remains a top ransomware initial access vector. Train users to recognize malicious emails and report suspicious activity.

5. Implement application allowlisting: Restrict execution of unauthorized binaries, scripts, and macros. Tools like Windows Defender Application Control (WDAC) or AppLocker can prevent execution of ransomware payloads.

6. Audit and reduce privileged access: Enforce least privilege, eliminate standing administrative access, implement Privileged Access Management (PAM), and monitor privileged account usage for anomalous behavior.

7. Develop and test incident response plans: Conduct tabletop exercises simulating ransomware scenarios. Ensure decision-makers understand ransom payment considerations, legal obligations, and communication strategies.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub