Classification: TLP:CLEAR | Publication Date: 2026-10-28 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

WHITEARMOR Ransomware Gang: 12 Leak-Site Listings in 5 Days — Cross-Sector Claims Spanning US, DE, AR, and CN

Executive Summary

Between 2026-10-24 and 2026-10-28, the ransomware group tracked as WHITEARMOR published 12 listings on its dark web leak site, naming organizations across the technology, transportation, retail & e-commerce, and government & defense sectors in Germany, the United States, Argentina, and China. Every one of these listings is an unverified accusation by a criminal organization. WHITEARMOR claims to have compromised these organizations; this briefing does not assert, and this data does not establish, that any breach occurred.

Notable aspects of the current campaign window:

• Posting velocity is elevated. Twelve listings in five days, with four published on 2026-10-27 alone, suggests either a batch-detonation event or a deliberate publicity push.
• Transportation logistics appears twice among US-named entities. WHITEARMOR names Ryder (2026-10-27) and J.B Hunt (2026-10-25) — both [MULTI-SOURCE and SINGLE-SOURCE tiers respectively, see below].
• Several listings are low-fidelity. Entries such as "wagyu.xyz unfairness," "Verification," and a raw Telegram URL (https://t.me/whitearmorxd) indicate sloppy or non-standard posting behavior, which we address in the Sourcing & Verification section.
• Government & defense sector presence: WHITEARMOR names Partido Liberal (AR), a political organization — consistent with opportunistic targeting of under-resourced public and political entities.

Enterprise defenders in technology, transportation/logistics, retail, and government sectors — particularly those with VMware vCenter, JetBrains TeamCity, Cisco FMC, or Check Point gateways exposed — should treat this reporting window as a prompt to run the hunts and hardening checks in this briefing.

Sourcing & Verification

This briefing is built from ransomware.live monitoring of WHITEARMOR's .onion leak site. Readers must understand exactly what this data is and is not:

• Corroboration tiers: 7 of the 12 listings were independently observed by a second leak-site crawler ([MULTI-SOURCE]); 5 appear on ransomware.live only ([SINGLE-SOURCE]: Verification, LoveSac, J.B Hunt, Partido Liberal, Hisense). MULTI-SOURCE means two independent crawlers saw the gang publish the claim. It does not mean the breach is confirmed. No tier in this dataset confirms a breach.
• Inclusion reflects the threat actor's claim and is NOT confirmation of a breach. Only the named organization or its regulator can confirm an incident.
• A named organization may dispute its listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Data quality caveats: Several listings in this window are anomalous — "wagyu.xyz unfairness" appears to be a grievance-style post rather than a standard victim entry, "Verification" lacks an identifiable organization, and one listing is a Telegram channel URL rather than a victim name. We report these as they appear because they reflect actual leak-site state, but analysts should weight them accordingly.

Security Arsenal will publish corrections to this briefing as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — WHITEARMOR

Caveat: WHITEARMOR is a lower-visibility brand than tier-one crews. Profile elements above combine observed leak-site behavior with cohort-level TTPs; treat granular figures as directional, not gospel.

Current Campaign Analysis

Sector Targeting

From the 12 listings in this window:

• Technology (3): Echo.com (DE), Hisense (CN), "Verification" (unidentifiable)
• Retail & E-Commerce (3): wagyu.xyz, gamblinglore, LoveSac (US)
• Transportation (2): Ryder (US), J.B Hunt (US)
• Other (2): wagyu.xyz unfairness (anomalous entry), Gamdom
• Government & Defense (1): Partido Liberal (AR)
• Not Found (1): the Telegram URL entry

The mix — gambling/gaming platforms (Gamdom, gamblinglore), consumer brands, logistics, and a political party — is classic affiliate-program opportunism rather than a vertically focused campaign.

Geographic Concentration

US-named entities lead identifiable geographies (Ryder, J.B Hunt, LoveSac), followed by single listings in Germany (Echo.com), Argentina (Partido Liberal), and China (Hisense). A CN listing is unusual for Western-facing RaaS crews and, combined with its SINGLE-SOURCE tier, warrants extra skepticism — possibly a reposted or recycled claim.

Victim Profile

Revenue exposure spans the full range: large enterprises (Ryder, J.B Hunt, Hisense, LoveSac are all nine-to-ten-figure-revenue organizations), mid-market e-commerce, and resource-constrained political/nonprofit entities. This spread is consistent with affiliates selling access obtained through indiscriminate scanning rather than deliberate target selection.

Posting Frequency & Escalation

Cadence in this window: 1 listing (10-24) → 3 (10-25) → 2 (10-26) → 4 (10-27) → 2 (10-28). The 10-27 cluster — four listings in one day, all MULTI-SOURCE — is the highest-confidence activity spike and the most likely window for genuine batch operations. Watch for whether the 10-27 cohort publishes proof-of-theft data packs; that is the gang's own next escalation lever.

CVE Exposure Hypothesis (NOT attributed to any specific victim)

We have no evidence linking any named listing to a specific CVE. The following is sector-level exposure analysis: WHITEARMOR's cohort is known to exploit internet-facing management and remote-access infrastructure, and all five CVEs below are on CISA's KEV with confirmed ransomware use. Organizations in the targeted sectors should verify patch status against these regardless of whether they appear on any leak site:

• CVE-2026-59310 — VMware vCenter path traversal (KEV 2026-08-18): virtualization management planes are the highest-value ransomware target; vCenter compromise enables mass VM encryption.
• CVE-2026-63077 — JetBrains TeamCity deserialization (KEV 2026-08-05): CI/CD compromise enables supply-chain-style payload staging and credential theft.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29): firewall management plane access enables policy manipulation and lateral movement.
• CVE-2026-50751 — Check Point Security Gateway improper authentication in IKEv1 (KEV 2026-06-08): VPN gateway initial access — the single most common entry vector for this cohort.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27): developer-tooling supply chain exposure relevant to technology-sector targets.

Detection Engineering

The following detections target TTPs associated with this cohort's playbook: VPN/remote-access exploitation, phishing macro execution, RDP brute forcing, PsExec/WMI lateral movement, Cobalt Strike-style beaconing, and pre-encryption data staging. Tune thresholds to your environment before production deployment.

---
title: WHITEARMOR Cohort - VPN Gateway Exploitation Followed by Internal RDP
id: 7a1e4c2d-9f3b-4e1a-b8c5-wa0000000001
status: experimental
description: Detects successful external VPN authentication from an unusual source IP followed within 30 minutes by RDP logon to an internal host by the same account — pattern consistent with CVE-2026-50751-style gateway compromise leading to lateral movement.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/10/28
modified: 2026/10/28
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1021.001
logsource:
  category: authentication
  product: windows
detection:
  selection_vpn:
    EventID: 4778
  selection_rdp:
    EventID: 4624
    LogonType: 10
  filter_known_ips:
    IpAddress|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_vpn and selection_rdp and not filter_known_ips
falsepositives:
  - Legitimate remote workers (baseline known VPN egress IPs and alert on deltas)
level: high
---
title: WHITEARMOR Cohort - Phishing Macro Execution Spawning Scripting or LOLBin Child
id: 7a1e4c2d-9f3b-4e1a-b8c5-wa0000000002
status: experimental
description: Detects Office applications spawning script interpreters or living-off-the-land binaries — consistent with macro-delivered initial access droppers used to stage Cobalt Strike or ransomware loaders.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/28
modified: 2026/10/28
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Office automation add-ins
level: high
---
title: WHITEARMOR Cohort - Pre-Encryption Staging - Shadow Copy Deletion and PsExec-Style Service Creation
id: 7a1e4c2d-9f3b-4e1a-b8c5-wa0000000003
status: critical
description: Correlates Volume Shadow Copy deletion attempts with remote service creation (PsExec/WMI-style, service names of random 8-16 chars) — a hallmark of pre-detonation ransomware staging and lateral spread.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/28
modified: 2026/10/28
tags:
  - attack.impact
  - attack.t1490
  - attack.lateral_movement
  - attack.t1569.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - CommandLine|contains|all:
        - 'vssadmin'
        - 'delete'
        - 'shadows'
    - CommandLine|contains|all:
        - 'wmic'
        - 'shadowcopy'
        - 'delete'
    - CommandLine|contains:
        - 'bcdedit'
        - 'recoveryenabled no'
  condition: selection_vss
falsepositives:
  - Backup software maintenance (rare; verify against change windows)
level: critical

The following Microsoft Sentinel hunt looks for the pre-ransomware staging pattern — new service installations on multiple servers from a single source host (PsExec/WMI spread) combined with shadow copy tampering — over a 72-hour lookback.

// WHITEARMOR cohort hunt: lateral spread + anti-recovery staging (72h)
let lookback = 72h;
let ServiceInstalls =
    SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 7045
    | extend ServiceName = tostring(split(EventData, "")[0])
    | project TimeGenerated, Computer, ServiceName, SubjectAccount = Account, IpAddress;
let ShadowTamper =
    SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 4688
    | where CommandLine has_any ("vssadmin delete shadows", "shadowcopy delete", "recoveryenabled no", "wbadmin delete catalog")
    | project TamperTime = TimeGenerated, Computer, Actor = Account, CommandLine;
ServiceInstalls
| summarize InstalledHosts = dcount(Computer), HostList = make_set(Computer), FirstSeen = min(TimeGenerated)
    by ServiceName, SubjectAccount
| where InstalledHosts >= 3   // same service pushed to 3+ hosts = spread behavior
| join kind=inner (ShadowTamper) on $left.SubjectAccount == $right.Actor
| project FirstSeen, SubjectAccount, ServiceName, InstalledHosts, HostList, TamperTime, Computer, CommandLine
| order by FirstSeen asc;

The script below is a rapid-response collector for hosts in the blast radius: it flags recently created scheduled tasks, shadow copy tampering, exposed RDP listeners, and suspicious new local admins — the four fastest checks when a leak-site listing names your organization or a peer.

# WHITEARMOR Rapid Triage — run elevated on suspect hosts (2026-10-28)
$cutoff = (Get-Date).AddDays(-7)
$report = [ordered]@{}

# 1. Scheduled tasks created in the last 7 days (persistence staging)
$report.NewScheduledTasks = Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt $cutoff
} | Select-Object TaskName, TaskPath, Date, @{n='Action';e={($_.Actions | Select-Object -First 1).Execute}}

# 2. Volume Shadow Copy state and recent VSS deletions
$report.ShadowCopies = (vssadmin list shadows 2>$null | Select-String 'creation time').Count
$report.VSSTamperEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Volume Shadow Copy' }

# 3. RDP exposure: enabled + listening + NLA status
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections).fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
$report.RDP = [pscustomobject]@{ Enabled=$rdpEnabled; NLA=($nla -eq 1); Listening=(Test-NetConnection -ComputerName localhost -Port 3389 -WarningAction SilentlyContinue).TcpTestSucceeded }

# 4. Local admin accounts created/modified recently
$report.NewLocalAdmins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
    ForEach-Object { Get-LocalUser -Name ($_.Name -split '\\')[-1] -ErrorAction SilentlyContinue } |
    Where-Object { $_.PasswordLastSet -gt $cutoff -or $_.LastLogon -gt $cutoff }

$report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\whitearmor_triage_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).json"
Write-Host "[+] Triage written to $env:TEMP — review NewScheduledTasks and NewLocalAdmins first."

Incident Response Priorities

T-Minus Detection Checklist (before encryption fires)

1. Anti-recovery activity: vssadmin/wmic shadow deletion, bcdedit ... recoveryenabled no, backup catalog deletion — the highest-fidelity pre-detonation signal.
2. Mass service creation: identical newly installed services across 3+ servers (see KQL above) — PsExec/WMI spread.
3. Staging directories: large archives (.zip, .7z, .rar) in unusual paths (C:\ProgramData, C:\Users\Public), especially with 7-Zip or WinRAR invoked from the command line.
4. Egress anomalies: sustained uploads to Mega, file.io, anonymous FTP, or unfamiliar cloud storage from server VLANs.
5. Security tool tampering: EDR service stop attempts, net stop on backup agents, GPO changes disabling defenses.
6. Authentication anomalies: VPN logons from new geographies followed by internal RDP (Sigma rule 1); impossible-travel on service accounts.

Assets This Cohort Historically Prioritizes for Exfiltration

• File shares containing HR, legal, and finance data (leak-site pressure value)
• Customer databases from e-commerce platforms (directly relevant to the retail/gambling listings in this window)
• Virtualization management planes (vCenter) — both for mass encryption and for credentials enabling domain dominance
• CI/CD servers (TeamCity and peers) — build artifacts, secrets, signing keys

Containment Actions — Ordered by Urgency

1. Isolate at the virtualization layer. If vCenter compromise is suspected, disconnect vCenter from the network first — it is the mass-encryption lever.
2. Disable compromised accounts and revoke VPN sessions for any account in rule-1 hits; force credential rotation for all accounts with recent remote-access logons.
3. Block egress to known staging/exfil destinations at the proxy and firewall; do not wait for confirmation of exfiltration.
4. Preserve VSS and offline backups immediately — verify at least one backup generation is offline/immutable before any further action.
5. Segment server VLANs to halt PsExec/WMI spread while scoping.
6. Engage IR retainer and legal/comms before any contact with the actor or response to leak-site pressure. Do not access the gang's negotiation portal from corporate infrastructure.

Hardening Recommendations

Immediate (24 hours)

• Verify patch status against all five KEV CVEs — CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console). CISA KEV listing means confirmed exploitation in the wild; treat as emergency change.
• Enforce phishing-resistant MFA on all remote access (VPN, RDP gateways, vCenter SSO) — gateway CVEs and credential stuffing are this cohort's front doors.
• Disable Office macro execution from internet-sourced files (Mark of the Web) via GPO if not already enforced.
• Deploy the Sigma rules and Sentinel query above and run the triage script on any host showing VPN-then-RDP sequences.
• Confirm immutable/offline backups and test one restore today, not during an incident.

Short-Term (2 weeks)

• Remove management planes from the internet. vCenter, FMC, TeamCity, and firewall management interfaces should be reachable only via jump host or dedicated admin network with device-conditional access.
• Segment by function: separate hypervisor management, backup infrastructure, and user VLANs; enforce host firewall rules blocking SMB/RPC between workstation segments.
• Deploy canary VSS/shadow artifacts with alerting on deletion attempts — cheap, near-zero-false-positive early warning.
• Implement egress filtering with category blocking for anonymous file-sharing and newly registered domains from server segments.
• Stand up leak-site monitoring for your organization, subsidiaries, and key suppliers so a listing triggers your IR playbook within hours, not weeks. Security Arsenal's monitoring flagged this campaign's postings the day they appeared.

Sourcing Note on This Briefing

All victim names, dates, sectors, and countries above come directly from WHITEARMOR leak-site postings observed via ransomware.live between 2026-10-24 and 2026-10-28 and are reproduced as claims. Nothing in this briefing should be read as confirmation that any named organization experienced a security incident.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub