Classification: TLP:CLEAR | Publication Date: 2026-09-26 | Source: ransomware.live leak-site monitoring | Nature of data: Unverified threat-actor claims

WALLSTREET Ransomware Gang: 7 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules

Executive Summary

Between 2026-09-24 and 2026-09-25, the WALLSTREET ransomware operation listed seven organizations on its dark web leak site: Beatus Cartons (Manufacturing, GB), GTFM (sector not disclosed, US), Ar Valve Resources (Energy & Utilities, GB), Tobin & Company (Financial Services, US), Breast Implant Center of Hawaii (Healthcare, US), Prater & Ridley Attorneys At Law (Professional Services, US), and Catholic University of El Salvador (Education, SV). These are threat-actor claims published to a criminal extortion site; none constitute confirmation that any named organization suffered an intrusion. The cluster spans seven distinct sectors with a geographic concentration in the United States (4 of 7) and United Kingdom (2 of 7), consistent with opportunistic double-extortion targeting rather than a single-sector campaign. Defenders in the affected sectors — particularly small-to-midsize manufacturers, regional law firms, specialty healthcare providers, and energy services firms — should treat this as a prompt to hunt for pre-encryption staging behaviors, regardless of whether their organization appears on the list.

Sourcing & Verification

• Corroboration posture: 7 of 7 listings were independently observed by a second leak-site crawler (multi-source). 0 listings appear on a single source only. Multi-source observation confirms the gang published the claim — it does not confirm any intrusion occurred.
• Nature of inclusion: Every organization named in this briefing is included solely because the WALLSTREET threat actor listed it on its leak site. Inclusion reflects the threat actor's claim and is not confirmation of a breach, compromise, or security incident.
• Disputes and denials: A named organization may dispute the listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question; only the organization or its regulator can confirm an incident.
• Corrections: Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — WALLSTREET

Attribution caveat: Public reporting specific to the WALLSTREET operation is limited. The profile below distinguishes what the current leak-site data supports from patterns typical of comparable double-extortion crews. Items marked as hypothesis should not be treated as confirmed gang tradecraft.

• Aliases: No widely documented alternate aliases are established in the current dataset. Track infrastructure and victim-posting cadence rather than name variants.
• Operating model (hypothesis): Posting cadence and sector diversity are consistent with either a small closed crew or an emerging RaaS brand recruiting initial-access brokers. The seven-sector spread in 48 hours suggests access purchased from brokers rather than organic intrusion capability across all verticals.
• Ransom posture (hypothesis): Typical of double-extortion operations in this tier: data theft threatened before or alongside encryption, with leak-site publication used as pressure. Specific demand figures are not established for this group.
• Initial access methods (sector-level hypothesis): Crews with this profile most commonly gain entry via exposed remote services (VPN concentrators, RDP), phishing with macro-enabled documents, and exploitation of edge/network appliances. The CISA KEV entries discussed below represent the exposure classes this profile of actor is known to exploit.
• Double extortion: The existence of a leak site with named organizations confirms an extortion-by-publication model. Exfiltration of sensitive data before detonation should be assumed in any suspected intrusion.
• Dwell time (hypothesis): Comparable crews typically dwell days to weeks between initial access and detonation. This creates a detection window — the T-minus checklist below is built around it.

Current Campaign Analysis

Sectors listed: Manufacturing (Beatus Cartons), Energy & Utilities (Ar Valve Resources), Financial Services (Tobin & Company), Healthcare (Breast Implant Center of Hawaii), Professional Services / legal (Prater & Ridley Attorneys At Law), Education (Catholic University of El Salvador), and one organization with no disclosed sector (GTFM). The spread across seven verticals in a 48-hour window indicates opportunistic targeting of available access rather than a sector-specific operation.

Geographic concentration: United States 4 of 7, United Kingdom 2 of 7, El Salvador 1 of 7. English-speaking jurisdictions dominate, consistent with actor preference for regions where extortion pressure and payment likelihood are perceived as higher.

Listed-organization profile: The named organizations skew toward small-to-midsize enterprises — a regional packaging manufacturer, a specialty valve/energy services firm, a boutique financial advisory, a single-specialty medical practice, a law firm, and a university. Estimated revenue bands for this profile range from low single-digit millions to mid-hundreds of millions USD. This is the classic mid-market extortion sweet spot: large enough to pay, frequently under-resourced in security operations, and often dependent on perimeter VPN/RDP and flat internal networks.

Posting frequency / escalation: Seven listings across two consecutive days (2026-09-24 to 2026-09-25) represents a burst pattern. Burst posting often follows batch acquisition of access from brokers, or a deliberate publicity push by a newer brand attempting to establish credibility. Watch for follow-on listings in the same sectors over the next 7–14 days and for claimed data-sample publication, which would indicate escalation from listing to leak.

CVE exposure hypothesis — not linked to any named organization: No evidence connects any specific CVE to any specific listing. The following CISA KEV entries represent edge and management-plane exposure that this profile of actor is known to exploit as initial access, and organizations in the listed sectors should verify remediation posture:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Perimeter VPN gateway exposure; directly relevant to the VPN-access hypothesis.
• CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password. Management-plane compromise enables policy tampering and lateral access.
• CVE-2026-59310 — Broadcom VMware vCenter path traversal. Virtualization management-plane access is a high-value pre-encryption target; vCenter compromise enables mass detonation.
• CVE-2026-63077 — JetBrains TeamCity deserialization. CI/CD compromise enables supply-chain-style payload distribution and credential theft.
• CVE-2026-48027 — Nx Console embedded malicious code. Developer-tooling supply chain exposure; relevant to build-environment credential theft.

Patch priority for defenders in listed sectors: perimeter gateways first (Check Point, Cisco FMC), then virtualization management (vCenter), then build infrastructure (TeamCity, developer tooling).

Detection Engineering

The following detections target TTPs associated with double-extortion operations of this profile: remote-service initial access, macro execution, and pre-encryption staging (credential access, lateral movement via WMI/PsExec, shadow copy deletion, archive staging). Tune thresholds to environment baselines.

---
title: RDP Brute Force Followed By Successful Logon - Potential Ransomware Initial Access
id: 7f3a1c2e-9b4d-4e6a-a1c5-wa11st001rdp
status: experimental
description: Detects burst of failed RDP logons from a single source followed by a successful logon, consistent with brute-force initial access used by ransomware operators.
author: Security Arsenal Threat Intel
logsource:
  category: authentication
  product: windows
detection:
  sel_failed:
    EventID: 4625
    LogonType: 10
  sel_success:
    EventID: 4624
    LogonType: 10
  condition: sel_failed and sel_success
timeframe: 10m
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1110
date: 2026/09/26
---
title: Office Macro Spawning Scripting Or Command Interpreter - Phishing Execution
id: 7f3a1c2e-9b4d-4e6a-a1c5-wa11st002mac
status: experimental
description: Detects Microsoft Office processes spawning cmd, powershell, wscript, cscript, or mshta, consistent with macro-based phishing payloads delivering ransomware loaders.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  sel_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  sel_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: sel_parent and sel_child
level: high
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
date: 2026/09/26
---
title: Pre-Ransomware Staging - Shadow Copy Deletion Or Remote Service Creation Via WMI PsExec
id: 7f3a1c2e-9b4d-4e6a-a1c5-wa11st003lm
status: experimental
description: Detects volume shadow copy deletion, PsExec-style service execution, or WMI remote process creation - high-fidelity pre-encryption and lateral movement indicators for double-extortion operators.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  sel_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
  sel_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
    CommandLine|contains:
      - '\\'
  sel_wmi_remote:
    ParentImage|endswith: '\wmiprvse.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  condition: 1 of sel_*
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
date: 2026/09/26

Hunt query for Microsoft Sentinel — surfaces pre-ransomware staging: new services created on remote hosts within 30 minutes of network logons, combined with shadow copy tampering and archive-tool execution on servers.

let lookback = 7d;
let RareRemoteLogons =
    SecurityEvent
    | where TimeGenerated >= ago(lookback)
    | where EventID == 4624 and LogonType in (3, 10)
    | where Account !endswith "$"
    | summarize LogonCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
        by Computer, Account, IpAddress
    | where LogonCount < 5;
let NewServices =
    SecurityEvent
    | where TimeGenerated >= ago(lookback)
    | where EventID == 7045
    | project ServiceTime = TimeGenerated, Computer, ServiceName, ServiceFileName, ServiceAccount;
let Staging =
    SecurityEvent
    | where TimeGenerated >= ago(lookback)
    | where EventID == 4688
    | where Process has_any ("vssadmin", "bcdedit", "wbadmin")
       or CommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no")
       or Process has_any ("7z.exe", "rar.exe", "winrar.exe")
    | project StageTime = TimeGenerated, Computer, Process, CommandLine, Account;
RareRemoteLogons
| join kind=inner NewServices on Computer
| where ServiceTime between (FirstSeen .. LastSeen + 30m)
| join kind=leftouter Staging on Computer
| project Computer, Account, IpAddress, FirstSeen, ServiceName, ServiceFileName, Process, CommandLine, StageTime
| order by FirstSeen asc;

Rapid-response triage script — run on suspect hosts and any server in scope of a suspected intrusion. Enumerates recently created scheduled tasks, RDP exposure, and shadow copy state.

# WALLSTREET-profile rapid triage - run elevated. Read-only; safe for IR sweeps.
$out = @{}

Write-Host "=== Scheduled tasks created/modified in last 7 days ===" -ForegroundColor Cyan
$out.Tasks = Get-ScheduledTask | ForEach-Object {
    $i = $_ | Get-ScheduledTaskInfo
    [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; LastRun=$i.LastRunTime; Author=$_.Author }
} | Where-Object { $_.Author -and $_.Name -notlike 'Microsoft*' }
$out.Tasks | Format-Table -AutoSize

Write-Host "=== RDP exposure check ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
$out.RDPEnabled = ($rdp.fDenyTSConnections -eq 0)
$out.NLAEnabled = ($nla.UserAuthentication -eq 1)
$out.RDPListening = (Test-NetConnection -ComputerName localhost -Port 3389 -WarningAction SilentlyContinue).TcpTestSucceeded
"RDP Enabled: $($out.RDPEnabled) | NLA: $($out.NLAEnabled) | 3389 Listening: $($out.RDPListening)"
if ($out.RDPEnabled -and -not $out.NLAEnabled) { Write-Host 'WARNING: RDP without NLA - brute-force exposure' -ForegroundColor Red }

Write-Host "=== Volume Shadow Copy status ===" -ForegroundColor Cyan
$out.Shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue |
  Select-Object DeviceObject, InstallDate, @{n='SizeGB';e={[math]::Round($_.Size/1GB,2)}}
if (-not $out.Shadows) { Write-Host 'WARNING: No shadow copies present - verify not deleted by actor' -ForegroundColor Red } else { $out.Shadows | Format-Table -AutoSize }

Write-Host "=== Suspicious services created in last 7 days ===" -ForegroundColor Cyan
$out.NewServices = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, @{n='Service';e={$_.Properties[0].Value}}, @{n='Binary';e={$_.Properties[1].Value}}
$out.NewServices | Format-Table -AutoSize

$out | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\triage_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).json"
Write-Host "Output written to $env:TEMP" -ForegroundColor Green

Incident Response Priorities

T-minus detection checklist — hunt these before encryption fires:

• Shadow copy deletion attempts (vssadmin, wmic shadowcopy delete, bcdedit recoveryenabled no) on any server.
• New services (Event ID 7045) with binaries in Temp, ProgramData, or user profile paths; PSEXESVC-style service names.
• Archive-tool execution (7z, rar, winrar) on file servers, especially invoked by non-admin interactive accounts or via WMI.
• Rare network logon types (LogonType 3/10) from IP addresses with no prior history to the host, followed by service creation within 30 minutes.
• Mass file-read bursts on shares hosting finance, legal, HR, or patient data — exfiltration staging precedes encryption.
• Office processes spawning script interpreters on endpoints of users in finance or executive assistants' groups.

Assets this profile of actor prioritizes for exfiltration: For the listed sectors, assume targeting of: legal matter files and privileged communications (law firms), patient records and imaging (specialty healthcare), client portfolios and wire instructions (financial advisory), CAD/schematics and process documentation (manufacturing and energy services), and student/HR records (education). Backup catalogs and virtualization management (vCenter) are priority targets for impact maximization.

Containment actions, ordered by urgency:

1. Isolate the affected host(s) from the network — do not power off; preserve memory for forensic capture.
2. Disable the suspected compromised account(s) and revoke active sessions/tokens, including VPN and M365 sessions.
3. Block identified C2 domains/IPs at egress; sinkhole internally.
4. Disable RDP externally at the perimeter; require VPN+MFA for any remote administration.
5. Protect backups: verify offline/immutable copies are intact and unreachable from production credentials; rotate backup service account credentials.
6. Seize and preserve artifacts: memory, $MFT, USN journal, Prefetch, ShimCache, scheduled task definitions, and security event logs before any cleanup.
7. Expand scope via the KQL query across the estate before declaring containment — assume lateral movement has already occurred.

Hardening Recommendations

Immediate (24 hours):

• Verify patch status on the KEV exposures relevant to your estate: Check Point Security Gateway (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), VMware vCenter (CVE-2026-59310), JetBrains TeamCity (CVE-2026-63077). If unpatched and internet-facing, restrict to management networks or take offline.
• Enforce MFA on all VPN and remote access; disable RDP from the internet entirely; enable NLA.
• Deploy the Sigma rules above to your SIEM and alert on the shadow-copy rule at critical priority.
• Audit scheduled tasks and services created in the last 14 days across servers using the triage script.
• Block macro execution from internet-sourced Office documents via GPO (Mark of the Web enforcement).

Short-term (2 weeks):

• Segment the network: isolate backup infrastructure, restrict server-to-server SMB/RDP/WinRM to tiered admin accounts, and place virtualization management (vCenter) on a dedicated management VLAN reachable only from PAWs.
• Implement LAPS and remove standing local admin rights; enforce tiered administration with no interactive logon by tier-0 accounts on endpoints.
• Deploy immutable/offline backups with separate credentials and test restoration of one critical workload per sector-relevant system (ERP, EHR, document management).
• Enable attack surface reduction rules (Office child-process creation, WMI persistence, credential theft from LSASS) in block mode after a 1-week audit pass.
• Establish egress filtering and DNS logging so exfiltration to newly registered or rare domains generates alerts before publication pressure arrives.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub