Classification: TLP:CLEAR | Publication Date: 2026-10-15 | Source: ransomware.live leak-site monitoring | Nature of data: Unverified threat-actor claims

WALLSTREET Ransomware Gang: 13 New Leak-Site Listings in 48 Hours — Sweden-Heavy Campaign Analysis & Detection Engineering

Executive Summary

Between 2026-10-13 and 2026-10-14, the ransomware group tracked as WALLSTREET listed 13 organizations on its dark web leak site, according to monitoring data aggregated via ransomware.live. These are claims made by a criminal group — inclusion on a leak site is an accusation of compromise, not proof of one.

The listing cluster shows a sharp geographic concentration: 8 of 13 named organizations are based in Sweden (SE), with additional listings in the United States (US) and Germany (DE). Sector-wise, professional services firms — notably a cluster of Swedish architecture and consulting practices — dominate the list, alongside healthcare providers in all three countries and single listings in transportation and manufacturing.

Key observations for defenders:

• Posting velocity: 11 of 13 listings were published on a single day (2026-10-13), suggesting either a batch-dump of previously negotiated/stalled victims or a coordinated intrusion wave with a common access vector.
• Healthcare exposure: Four healthcare listings (Green Clinic, Lambertinum Seniorenwohnanlage, Danvikshem (Stiftelsen Danviks Hospital), and one additional care-sector entity pattern) put patient-data regulatory exposure (HIPAA, GDPR Article 9 special categories) on the table for any organization in this sector that shares infrastructure profiles with those named.
• Detection opportunity: WALLSTREET's known playbook — edge-device exploitation, RDP/VPN intrusion, PsExec/WMI lateral movement, and staged exfiltration before encryption — is highly detectable 24–72 hours before detonation. The Sigma and KQL content in this briefing targets exactly that window.

Organizations in healthcare, professional services, and manufacturing in the US, Germany, and especially Sweden should treat this posting cluster as a trigger to run the hunts below against the last 14 days of telemetry — regardless of whether they appear on any leak site.

Sourcing & Verification

• Corroboration of the claim, not the breach: 13 of 13 listings were independently observed by a second leak-site crawler; 0 listings appear on a single source only. This multi-source observation confirms that WALLSTREET did publish these claims on its leak site. It does not confirm that any named organization was breached.
• Inclusion in this briefing reflects the threat actor's claim and is NOT confirmation of a breach. No tier in our monitoring data — including multi-source crawler observation — can verify an intrusion. Only the affected organization, its forensic responders, or its regulator can confirm a breach.
• Denials and silence are equally inconclusive. A named organization may dispute its listing, and a denial is not proof the claim is false — just as the listing is not proof the claim is true. Disclosure obligations vary by jurisdiction and sector, and not every incident is legally reportable. Neither silence nor denial settles the question; we report the actor's claim, nothing more.
• Corrections: Security Arsenal will publish corrections to this briefing as verified information emerges. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — WALLSTREET

Note: The following profile reflects open-source and underground tracking of the WALLSTREET operation. Attribution and TTP details for this group carry moderate confidence and may overlap with rebranded predecessor operations, as is common in the ransomware ecosystem.

Known aliases / branding: WALLSTREET (also referenced in underground forums under Wall Street / WS-themed branding consistent with its extortion imagery). No definitive public linkage to a sanctioned predecessor brand has been established; analysts should treat possible rebrand lineage as an open question.

Operating model: WALLSTREET exhibits characteristics of a closed or semi-closed Ransomware-as-a-Service (RaaS) operation — a core team controlling the leak site and negotiation infrastructure, with a limited affiliate pool rather than open recruitment. The tight geographic clustering in this campaign (8 Swedish listings in one day) is consistent with a single affiliate working a regional target set, which is more typical of vetted-affiliate models than mass open RaaS.

Typical ransom demands: Based on observed negotiation patterns for groups with this victim profile (mid-market European and US firms), demands typically land in the low-to-mid six figures USD, scaled to perceived victim revenue, with a secondary demand for data-deletion under double extortion.

Known initial access methods (in priority order of observed use):

1. Edge device / VPN exploitation — exploitation of internet-facing remote access infrastructure (firewalls, VPN concentrators, virtualization management planes). This maps directly to the current KEV cluster discussed below.
2. Phishing with macro-enabled or script-based payloads — leading to loader execution and hands-on-keyboard follow-on.
3. Exposed RDP — brute force or purchased/credentialed access via initial access brokers.
4. Supply chain / tooling compromise — abuse of legitimate developer and management tooling already present in the environment.

Double extortion approach: Yes. WALLSTREET operates a classic double-extortion model: data is staged and exfiltrated before encryption, and the leak site listing is used as negotiation leverage. Publication of a name on the leak site typically indicates either stalled negotiations, refusal to engage, or a public pressure escalation — the named organization may or may not have an active encryption event.

Average dwell time: Consistent with peer groups of this maturity, estimated dwell time from initial access to detonation is 3–10 days, with data staging and exfiltration activity concentrated in the final 24–72 hours. That final window is where the detection content below is aimed.

Current Campaign Analysis

Sector Targeting

From the 13 listings published 2026-10-13 through 2026-10-14:

The five professional services listings are all Swedish architecture, urbanism, and consulting practices — an unusually tight vertical cluster. This pattern suggests the affiliate behind this wave may have used a single common exposure across these firms: a shared managed service provider, a common line-of-business application, or identical perimeter stacks. Defensive implication: if your organization serves this vertical (or is served by the same MSPs common to it), assume shared-fate risk and hunt accordingly.

Geographic Concentration

• Sweden (SE): 8 listings — dominant target set
• United States (US): 2 listings (Green Clinic, E-Z Pack Trucks)
• Germany (DE): 1 listing (Lambertinum Seniorenwohnanlage)

A single-day, single-country dump of this shape is not characteristic of opportunistic spraying. It reads as deliberate regional campaign execution or the batch publication of a backlog from one affiliate's access pipeline.

Victim Profile

The named organizations are predominantly small-to-mid-market enterprises — architecture firms, clinics, regional care facilities, and specialist manufacturers — typically in the $5M–$150M revenue band based on sector norms for organizations of this type in Sweden, Germany, and the US. This is the classic WALLSTREET-style target band: large enough to pay a six-figure ransom, small enough to lack a 24/7 SOC, and frequently dependent on outsourced IT/MSP arrangements that create the shared-exposure risk noted above. Healthcare listings add regulatory leverage (GDPR special-category data in the EU entities; HIPAA in the US), which the gang uses as pressure in negotiations.

Posting Frequency / Escalation Pattern

• 2026-10-13: 11 listings (batch dump)
• 2026-10-14: 2 listings (Green Clinic, E-Z Pack Trucks — the US pair)

Batch publication of 11 victims in one day, followed by 2 more across a different geography the next day, is consistent with either (a) negotiation deadlines expiring simultaneously across one affiliate's caseload, or (b) a fresh intrusion wave being monetized quickly. Either way, posting velocity this compressed historically precedes additional listings from the same campaign within 7–14 days. Swedish professional services and healthcare organizations not on this list should assume the campaign is not finished.

CVE Exposure Context (Hypothesis — Not Attribution)

We have no evidence linking any specific named listing to any specific CVE. The following is sector-level exposure analysis framed strictly as hypothesis: given WALLSTREET's known preference for edge-device exploitation as an initial access vector, the currently exploited vulnerabilities below represent the most plausible exposure surface for campaigns of this shape, and all are confirmed ransomware-associated per CISA KEV:

• CVE-2026-50751 — Check Point Security Gateway Improper Authentication (IKEv1) — Added to KEV 2026-06-08. Improper authentication in IKEv1 key exchange is a direct VPN-edge intrusion path. This is the highest-priority hypothesis for a campaign hitting many small firms with homogeneous perimeter gear.
• CVE-2026-20316 — Cisco Secure Firewall Management Center Hard-coded Password — Added to KEV 2026-07-29. FMC compromise yields both access and centralized visibility into the firewall estate — a force multiplier for lateral movement.
• CVE-2026-59310 — VMware vCenter Path Traversal — Added to KEV 2026-08-18. vCenter compromise is a classic pre-ransomware objective: control of the virtualization layer enables mass hypervisor-level encryption, which is how groups achieve maximum blast radius in mid-market victims.
• CVE-2026-63077 — JetBrains TeamCity Deserialization (unauthenticated RCE) — Added to KEV 2026-08-05. CI/CD server compromise enables supply-chain-style persistence and credential harvesting — relevant given the consulting/architecture vertical's developer tooling.
• CVE-2026-48027 — Nx Console Embedded Malicious Code — Added to KEV 2026-05-27. A malicious-package vector consistent with developer-workstation initial access in professional services firms.

Actionable translation: if you run any of these products, patch/verify now, and hunt for exploitation attempts in perimeter logs from 2026-09-01 onward. A Swedish professional services firm running Check Point or a shared MSP-managed firewall stack is the exact target profile this campaign has produced.

Detection Engineering

The rules below target WALLSTREET's known playbook: VPN/edge intrusion, phishing payload execution, RDP brute force, PsExec/WMI lateral movement, and pre-encryption data staging and shadow copy destruction.

---
title: WALLSTREET - Pre-Ransomware Data Staging via Archive Utilities
id: 7c1f9a2e-ws01-4b3d-9e5f-20261015a001
status: experimental
description: Detects mass archive creation (rar/7z) in user or temp directories, consistent with WALLSTREET-style data staging prior to double-extortion exfiltration. Tune exclusions for backup software.
author: Security Arsenal Threat Intelligence
date: 2026/10/15
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' -r'
      - '\AppData\Local\Temp'
      - '\Users\Public'
      - '.zip'
      - '.7z'
      - '.rar'
  filter_backup:
    CommandLine|contains:
      - 'Veeam'
      - 'Veritas'
      - 'Commvault'
  condition: selection_img and selection_cli and not filter_backup
falsepositives:
  - Legitimate compression by end users or backup tooling
level: high
tags:
  - attack.collection
  - attack.t1560.001
---
title: WALLSTREET - Lateral Movement via PsExec Service Install or WMI Remote Process
id: 7c1f9a2e-ws02-4b3d-9e5f-20261015a002
status: experimental
description: Detects PsExec-style remote service installation and WMI remote process creation, hallmarks of WALLSTREET hands-on-keyboard lateral movement between initial access and encryption.
author: Security Arsenal Threat Intelligence
date: 2026/10/15
logsource:
  product: windows
detection:
  psexec_service:
    Channel: 'System'
    EventID: 7045
    ServiceFileName|contains:
      - 'PSEXESVC'
      - '\ADMIN$'
      - '\C$\Windows\'
  wmi_remote:
    Channel: 'Microsoft-Windows-Sysmon/Operational'
    EventID: 1
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
  condition: psexec_service or wmi_remote
falsepositives:
  - Legitimate remote administration by IT teams; baseline admin workstations and exclude known management hosts
level: high
tags:
  - attack.lateral-movement
  - attack.t1569.002
  - attack.t1047
---
title: WALLSTREET - Volume Shadow Copy Deletion Prior to Encryption
id: 7c1f9a2e-ws03-4b3d-9e5f-20261015a003
status: experimental
description: Detects shadow copy deletion and boot configuration tampering via vssadmin, wmic, or bcdedit - near-universal pre-encryption behavior in WALLSTREET-class ransomware operations. High-fidelity pre-detonation tripwire.
author: Security Arsenal Threat Intelligence
date: 2026/10/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains:
        - 'delete shadows'
        - 'resize shadowstorage'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy delete'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains:
        - 'recoveryenabled no'
        - 'ignoreallfailures'
    - Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
      CommandLine|contains:
        - 'Get-WmiObject Win32_Shadowcopy'
        - 'Remove-CimInstance'
        - 'Win32_ShadowCopy'
  condition: selection_vss
falsepositives:
  - Rare; legitimate storage admin activity. Verify against change windows, but treat as critical by default
level: critical
tags:
  - attack.impact
  - attack.t1490

// WALLSTREET Campaign Hunt: Pre-encryption staging + lateral movement correlation (14d)
// Microsoft Sentinel / Defender XDR — run across all endpoints, prioritize SE/DE/US
// healthcare and professional services assets.

let Lookback = 14d;
let SuspiciousStaging =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("rar.exe", "7z.exe", "7za.exe", "winrar.exe")
    | where ProcessCommandLine has_any (" a ", " -r", ".zip", ".7z")
    | project StagingTime=Timestamp, DeviceName, StagingAccount=AccountName, StagingCmd=ProcessCommandLine;
let LateralMovement =
    DeviceEvents
    | where Timestamp > ago(Lookback)
    | where ActionType == "ServiceInstalled"
    | extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
    | where ServiceName has_any ("PSEXESVC") or tostring(AdditionalFields) has "ADMIN$"
    | project LateralTime=Timestamp, DeviceName, ServiceName;
let ShadowTamper =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
        or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy delete")
        or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled no")
    | project TamperTime=Timestamp, DeviceName, TamperCmd=ProcessCommandLine;
let RDPBruteForce =
    DeviceLogonEvents
    | where Timestamp > ago(Lookback)
    | where LogonType == "RemoteInteractive"
    | summarize FailedAttempts = countif(ActionType == "LogonFailed"),
              SuccessAfterFail = countif(ActionType == "LogonSuccess")
        by DeviceName, AccountName, RemoteIP
    | where FailedAttempts >= 10 and SuccessAfterFail >= 1
    | project DeviceName, AccountName, RemoteIP, FailedAttempts;
SuspiciousStaging
| join kind=leftouter LateralMovement on DeviceName
| join kind=leftouter ShadowTamper on DeviceName
| join kind=leftouter RDPBruteForce on DeviceName
| extend SignalCount = (iff(isnotnull(StagingCmd),1,0) + iff(isnotnull(ServiceName),1,0)
         + iff(isnotnull(TamperCmd),1,0) + iff(isnotnull(RemoteIP),1,0))
| where SignalCount >= 2
| summarize arg_max(StagingTime, *) by DeviceName
| project DeviceName, StagingAccount, StagingCmd, ServiceName, TamperCmd, RemoteIP, FailedAttempts, SignalCount
| order by SignalCount desc, StagingTime desc

# WALLSTREET Rapid Triage — run on critical servers / hypervisor hosts
# Checks: exposed RDP, scheduled tasks (7d), shadow copy tampering, suspicious archive staging
# Requires: Run as Administrator. Read-only; safe for production.

Write-Host "=== WALLSTREET Rapid Triage $(Get-Date -Format 'yyyy-MM-dd HH:mm') ===" -ForegroundColor Cyan

# 1) Exposed RDP check
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$rdpFirewall = Get-NetFirewallRule -DisplayGroup 'Remote Desktop' -ErrorAction SilentlyContinue |
               Where-Object {$_.Enabled -eq 'True'}
if ($rdpEnabled -and $rdpFirewall) {
    Write-Host "[ALERT] RDP is ENABLED with firewall rules active." -ForegroundColor Red
    $nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
    Write-Host "        NLA enforced: $($nla -eq 1)  |  Recommend: disable RDP or restrict by VPN+IP allowlist"
}

# 2) Scheduled tasks created/modified in last 7 days (persistence check)
Write-Host "`n--- Scheduled tasks created in last 7 days ---" -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {$_.Date -and [datetime]$_.Date -gt (Get-Date).AddDays(-7)} |
    Select-Object TaskName, TaskPath, Date, @{n='Author';e={$_.Author}} | Format-Table -AutoSize

# 3) Volume Shadow Copy status & recent deletion events
Write-Host "`n--- Shadow copies present ---" -ForegroundColor Yellow
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) { $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }
else { Write-Host "[ALERT] NO shadow copies found - verify this is expected. Deletion is a pre-encryption indicator." -ForegroundColor Red }

Write-Host "`n--- Recent vssadmin/bcdedit execution (System log, 7d) ---" -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object {$_.Message -match 'vssadmin.*delete shadows|bcdedit.*recoveryenabled|wmic.*shadowcopy'} |
    Select-Object TimeCreated, Message | Format-List

# 4) Suspicious large archives staged in temp/public dirs (last 7d)
Write-Host "`n--- Large archives (>50MB) in Temp/Public, last 7 days ---" -ForegroundColor Yellow
$paths = @("$env:TEMP", "C:\Users\Public", "C:\Windows\Temp")
foreach ($p in $paths) {
    Get-ChildItem $p -Recurse -Include *.zip,*.rar,*.7z -ErrorAction SilentlyContinue |
        Where-Object {$_.Length -gt 50MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-7)} |
        Select-Object FullName, @{n='SizeMB';e={[math]::Round($_.Length/1MB)}}, LastWriteTime
}

# 5) Failed RDP logons (brute-force signature, 24h)
Write-Host "`n--- Failed logons by source IP (24h, >10 = suspicious) ---" -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
    ForEach-Object { if ($_.Message -match 'Source Network Address:\s+([\d\.]+)') {$matches[1]} } |
    Group-Object | Where-Object {$_.Count -gt 10} | Sort-Object Count -Descending |
    Select-Object @{n='SourceIP';e={$_.Name}}, Count | Format-Table -AutoSize

Write-Host "`n=== Triage complete. Escalate any [ALERT] findings to IR immediately. ===" -ForegroundColor Cyan

Incident Response Priorities

T-Minus Detection Checklist (pre-encryption window)

If any of the following fire in the same 72-hour window on the same asset or subnet, treat as an active pre-detonation intrusion until proven otherwise:

1. Authentication anomalies: ≥10 failed RDP/VPN logons from a single external IP followed by a success; impossible-travel logons on admin accounts.
2. New remote service installs: Event 7045 with PSEXESVC or services executing from ADMIN$ — especially outside change windows.
3. WMI-spawned shells: WmiPrvSE.exe spawning cmd.exe/powershell.exe (Sigma rule 2 above).
4. Staging behavior: rar.exe/7z.exe creating large archives in Temp/Public paths; abnormal outbound transfer volumes to unfamiliar IPs or cloud storage (Mega, file.io, Rclone-style patterns).
5. vCenter/hypervisor logins from non-admin workstations — given CVE-2026-59310 exposure, any vCenter session from an unapproved source is critical.
6. Shadow copy tampering: vssadmin/bcdedit/wmic execution matching Sigma rule 3. This is your last tripwire — encryption typically follows within hours.

Assets WALLSTREET-Style Operations Prioritize for Exfiltration

• Healthcare entities: patient records, clinical databases, insurance/billing exports — special-category data that maximizes regulatory pressure (GDPR Art. 9 / HIPAA).
• Professional services (architecture/consulting): client project files, contracts, financial records — the gang leverages third-party confidentiality obligations as extortion pressure.
• All victims: domain controller NTDS.dit, finance/payroll shares, executive mailboxes, and backup catalogues (to locate and destroy recovery options).

Containment — Ordered by Urgency

1. Isolate at the network layer, not by shutdown. Segment the affected subnet/VLAN immediately. Do NOT power off hosts — volatile memory and in-progress exfil channels are evidence.
2. Disable compromised and suspected-privileged accounts (tier-0 first): force password resets on DA/EA accounts, revoke active sessions and tokens.
3. Block egress to identified exfil destinations at the firewall/proxy; sinkhole C2 domains observed in EDR telemetry.
4. Preserve backup infrastructure: take backup catalogs and repositories offline or immutable-lock them before the operator reaches them — backup destruction typically precedes encryption by hours.
5. Snapshot forensic state: capture memory and triage images from patient-zero and the staging host before remediation.
6. Engage IR counsel and review disclosure obligations early — GDPR 72-hour clocks and sector-specific regulators do not pause for investigation. Note: being listed on a leak site does not itself confirm a reportable breach; verification of the claim is the first legal dependency.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV perimeter set: Check Point Security Gateway (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), VMware vCenter (CVE-2026-59310), JetBrains TeamCity (CVE-2026-63077). If patching is not possible in 24h, take the management interface off the internet entirely.
• Kill exposed RDP: disable internet-facing RDP; require VPN + MFA + IP allowlisting. Audit 4625 failures from the last 7 days for brute-force patterns.
• Enforce phishing-resistant MFA on all remote access and email; disable legacy/IKEv1 VPN authentication paths where feasible.
• Enable Office macro blocking from the internet (Mark-of-the-Web enforcement) via GPO; block child processes of Office apps via attack surface reduction rules.
• Deploy the three Sigma rules and the KQL query above into your SIEM/EDR now, and run the PowerShell triage script on domain controllers, file servers, and hypervisor hosts.
• Verify backup integrity and offline copies: confirm at least one immutable/offline restore point exists and test a restore.

Short-Term (2 weeks)

• Segment the network: isolate healthcare/clinical systems, backup infrastructure, and hypervisor management planes into dedicated VLANs with deny-by-default east-west rules. Mid-market firms are hit hardest by flat networks — the Swedish cluster's blast radius pattern reflects this.
• Review MSP/shared-service trust: given the suspected shared-exposure vector in the professional services cluster, audit all MSP remote access tooling, enforce per-customer credentials, and require MSPs to attest to their own MFA/patching posture.
• Deploy EDR with tamper protection to all servers including vCenter-adjacent management boxes; enable block mode, not audit-only.
• Implement application control (WDAC/AppLocker) blocking unsigned binaries in user-writable paths — kills the loader-and-staging phase.
• Egress filtering and DLP alerting: alert on outbound transfers >5GB to non-corporate destinations; this catches the exfiltration that powers double extortion before encryption ever fires.
• Tabletop the double-extortion scenario: rehearse the decision tree for a leak-site listing that cannot yet be verified — legal, comms, and regulator-notification paths should be decided before you need them.

This briefing is based on unverified claims published by a criminal threat actor and observed via ransomware.live leak-site monitoring. All named organizations are referred to solely as entities the group claims to have compromised. Security Arsenal does not assert that any breach occurred. Named organizations may contact security@securityarsenal.com regarding this report.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub