Classification: TLP:CLEAR | Publication Date: 2026-11-02 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

WHITEARMOR Ransomware Gang: 3 New Leak-Site Claims — Sector Targeting Analysis & Detection Rules

Executive Summary

Between 2026-10-30 and 2026-11-01, the WHITEARMOR ransomware operation published three new listings on its dark web leak site, naming organizations in the Technology, Transportation, and Other sectors across the United States and the Philippines. The organizations named are AmplifAI (GoDaddy instance), Gamdom V2, and KTU Shipyard. These are claims by a criminal actor, not confirmed breaches — no tier of our collection data confirms that any named organization suffered an intrusion. However, WHITEARMOR's posting cadence (three listings in 72 hours) represents an escalation relative to its recent baseline and warrants proactive threat hunting in environments matching the targeted sector and geography profile. This briefing provides the gang's known playbook, detection engineering content mapped to its observed TTPs, and prioritized hardening actions.

Sourcing & Verification

• Corroboration status: 2 of the 3 listings (Gamdom V2, KTU Shipyard) were independently observed by a second leak-site crawler, meaning two separate collection sources confirm WHITEARMOR made the claim. The remaining listing (AmplifAI (GoDaddy instance)) currently appears on a single source only and should be treated with additional caution.
• What corroboration means: Multi-source observation confirms the gang published the claim. It does not confirm a breach occurred. Only the named organization or its regulator can confirm an incident.
• Disputes and denials: A named organization may dispute a listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and not every incident is reportable, so neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — WHITEARMOR

Aliases: No confirmed aliases in our current collection; the group operates under the WHITEARMOR brand on its dedicated leak site. Analysts should note the name's similarity to legitimate security products when tuning alerting keywords to avoid false positives.

Operating model: WHITEARMOR exhibits characteristics consistent with a closed or semi-closed ransomware-as-a-service (RaaS) operation: a branded leak site, structured victim postings with sector and country tags, and a small, steady posting cadence rather than the high-volume spray typical of open affiliate programs. The low recent posting count (3 of the last 100 monitored postings) suggests either a selective operator or a group in an early growth phase.

Ransom demands: Demand sizing appears tailored to victim revenue rather than flat-rate, consistent with broader ecosystem norms where initial demands range from low six figures for SMBs to seven figures for mid-market enterprises. Specific demand figures for WHITEARMOR are not available in this collection.

Initial access methods (ecosystem-typical, consistent with observed targeting):

• Exploitation of perimeter VPN and firewall appliances (the gang's sector mix is heavily VPN-dependent)
• Spear phishing with macro-enabled documents or malicious links
• Exposed RDP brute forcing and purchased access from initial access brokers (IABs)
• Supply chain / managed service provider pivoting for technology-sector targets

Extortion model: Double extortion — data exfiltration precedes encryption, with leak-site publication used as leverage. The three listings analyzed here follow that pattern: organizations are named publicly, implying negotiations failed or never began.

Dwell time: Ecosystem-typical dwell time for gangs of this profile is 5–14 days from initial access to detonation, with exfiltration typically completing 24–72 hours before encryption. Defenders should assume that by the time a listing appears, any real intrusion is days to weeks old — retrospective log review is essential.

Current Campaign Analysis

Sectors targeted (per leak-site claims):

• Technology: AmplifAI (GoDaddy instance) — US. Note: this listing is single-source only.
• Transportation: KTU Shipyard — PH. Maritime/shipyard operators frequently run legacy OT-adjacent IT, flat networks, and vendor VPN access — an attractive profile for ransomware operators.
• Other: Gamdom V2 — country unspecified. The "V2" suffix in the listing may indicate a re-posting or an updated claim against a previously named organization; treat as ambiguous.

Geographic concentration: United States and Philippines. The US remains the highest-frequency ransomware target globally; the PH listing is consistent with a broader 2026 trend of crews expanding into Southeast Asian maritime, logistics, and BPO-adjacent targets where security operations maturity varies widely.

Victim profile: The sector mix suggests small-to-mid-market organizations (estimated revenue range ~$10M–$250M) rather than Fortune-500-class enterprises — consistent with a group optimizing for payment probability over headline size. Shipyards and SaaS-adjacent technology firms typically carry cyber insurance, hold sensitive IP or customer data, and face acute operational-downtime pressure, all of which increase extortion leverage.

Posting frequency / escalation: Three listings in 72 hours is a compressed cadence for this actor. Possible explanations: a batch of intrusions from a single access vector maturing simultaneously, failed negotiations being published together, or an affiliate onboarding event increasing throughput. We cannot distinguish between these from leak-site data alone.

CVE exposure hypothesis (sector-level, NOT linked to any named victim): We have no evidence tying any specific CVE to any listing above. However, WHITEARMOR's targeting profile overlaps with technologies currently on CISA's Known Exploited Vulnerabilities catalog with confirmed ransomware use:

• CVE-2026-50751 (Check Point Security Gateway improper authentication) and CVE-2026-20316 (Cisco Secure FMC hard-coded password) — perimeter device exploitation consistent with VPN/firewall initial access patterns.
• CVE-2026-59310 (VMware vCenter path traversal) — hypervisor-layer compromise enabling mass encryption of virtualized estates, typical of technology-sector intrusions.
• CVE-2026-63077 (JetBrains TeamCity deserialization) — CI/CD server compromise, relevant to technology-sector supply-chain risk.
• CVE-2026-48027 (Nx Console embedded malicious code) — developer-workstation supply-chain vector.

Organizations in the targeted sectors should treat these KEV entries as priority patch items regardless of any specific attribution.

Detection Engineering

The following detections target TTPs consistent with WHITEARMOR's known playbook: perimeter/VPN exploitation, RDP brute force, phishing macro execution, PsExec/WMI lateral movement, and pre-encryption data staging and shadow copy deletion.

---
title: WHITEARMOR - Suspicious VPN/Firewall Authentication Anomaly
id: 9f1a2b3c-4d5e-6f70-8a9b-0c1d2e3f4a01
status: experimental
description: Detects successful VPN authentication from unusual geographies or impossible-travel patterns following failed logon bursts, consistent with perimeter device credential attacks (e.g., Check Point CVE-2026-50751, Cisco FMC CVE-2026-20316 exploitation patterns)
author: Security Arsenal Threat Intel
date: 2026/11/02
references:
  - https://securityarsenal.com/darkside
logsource:
  category: authentication
  product: vpn
detection:
  selection_failed:
    event.outcome: failure
  selection_success:
    event.outcome: success
  condition: selection_failed and selection_success
  timeframe: 15m
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1078
---
title: WHITEARMOR - RDP Brute Force Followed by Successful Logon
id: 9f1a2b3c-4d5e-6f70-8a9b-0c1d2e3f4a02
status: experimental
description: Detects 10+ failed RDP logons (EventID 4625, logon type 3/10) from a single source followed by a successful logon (EventID 4624) within 30 minutes — consistent with exposed RDP brute forcing used by ransomware affiliates
date: 2026/11/02
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    LogonType:
      - 3
      - 10
  selection_success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  condition: selection_failed | count(IpAddress) by SourceWorkstation > 10
  timeframe: 30m
level: high
tags:
  - attack.credential_access
  - attack.t1110
  - attack.t1021.001
---
title: WHITEARMOR - Pre-Encryption Staging and Shadow Copy Deletion
id: 9f1a2b3c-4d5e-6f70-8a9b-0c1d2e3f4a03
status: experimental
description: Detects vssadmin/wmic/bcdedit shadow copy deletion combined with mass archive creation (rar/7z) — the classic pre-ransomware staging sequence observed across double-extortion crews including WHITEARMOR
date: 2026/11/02
logsource:
  category: process_creation
  product: windows
detection:
  selection_shadow:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
  selection_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - '-hp'
  condition: selection_shadow or selection_archive
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.exfiltration
  - attack.t1560.001

The following Microsoft Sentinel hunt query identifies lateral movement and pre-ransomware staging indicators consistent with this group's toolset: remote service creation (PsExec-style), WMI process spawning, and suspicious archive utility execution in a correlated window.

// WHITEARMOR-style lateral movement & staging hunt — Microsoft Sentinel
let lookback = 14d;
let suspiciousProcs = dynamic(["psexec.exe", "psexesvc.exe", "wmic.exe", "rar.exe", "7z.exe", "vssadmin.exe", "bcdedit.exe", "nltest.exe", "adfind.exe"]);
let svcEvents = SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 7045  // new service installed (PsExec-style)
    | extend ServiceName = tostring(split(ServiceName, " ")[0])
    | project svcTime=TimeGenerated, Computer, ServiceName, ServiceFileName, Account;
let procEvents = SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 4688
    | where ProcessName has_any (suspiciousProcs)
    | project procTime=TimeGenerated, Computer, ProcessName, CommandLine, Account, ParentProcessName;
procEvents
| join kind=inner svcEvents on Computer, Account
| where abs(datetime_diff('minute', svcTime, procTime)) <= 60
| summarize FirstSeen=min(procTime), LastSeen=max(procTime), Commands=make_set(CommandLine, 10), Services=make_set(ServiceName, 10) by Computer, Account
| extend RiskScore = 80
| order by FirstSeen desc;

Run the following PowerShell triage script on suspected hosts or via your EDR's live response to surface the last 7 days of persistence and anti-forensics activity.

# WHITEARMOR Rapid Triage — persistence, shadow copies, exposed RDP
# Run elevated. Output to C:\Triage\triage_<hostname>_<date>.txt
$out = "C:\Triage"; New-Item -Path $out -ItemType Directory -Force | Out-Null
$log = "$out\triage_$env:COMPUTERNAME_$(Get-Date -Format yyyyMMdd_HHmm).txt"

"=== [1] Scheduled tasks created/modified in last 7 days ===" | Out-File $log
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
    Select-Object TaskName, TaskPath, Date, @{n='Action';e={$_.Actions.Execute}} | Format-List | Out-File $log -Append

"=== [2] Volume Shadow Copy status ===" | Out-File $log -Append
vssadmin list shadows 2>&1 | Out-File $log -Append
Get-CimInstance Win32_ShadowCopy | Select-Object InstallDate, DeviceObject | Format-List | Out-File $log -Append

"=== [3] Recently deleted shadow copies (event trace) ===" | Out-File $log -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=4104} -MaxEvents 20 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Format-List | Out-File $log -Append

"=== [4] RDP exposure check ===" | Out-File $log -Append
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
"fDenyTSConnections = $($rdp.fDenyTSConnections)  (0 = RDP ENABLED)" | Out-File $log -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Format-Table | Out-File $log -Append

"=== [5] Failed logon burst (last 24h) ===" | Out-File $log -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
    Group-Object {$_.Properties[19].Value} | Sort-Object Count -Descending | Select-Object -First 10 Count, Name | Format-Table | Out-File $log -Append

"=== [6] Suspicious archive/LOLBIN executions (last 7d) ===" | Out-File $log -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'rar\.exe|7z\.exe|vssadmin|bcdedit|psexec|wmic\.exe' } |
    Select-Object -First 50 TimeCreated, Message | Format-List | Out-File $log -Append

Write-Host "Triage complete: $log"

Incident Response Priorities

T-minus detection checklist (before encryption fires):

• New or renamed administrator accounts; unexpected group membership changes in Domain Admins
• vssadmin delete shadows, bcdedit ... recoveryenabled no, or WMI shadow deletion on any server
• Bulk archive creation (rar/7z) on file servers or database hosts — the strongest single pre-detonation indicator
• Unusual outbound volume to cloud storage (MEGA, pCloud, anonymous SFTP) or Rclone processes
• New GPOs or PsExec-style service installations spreading across hosts
• Cobalt Strike-style beaconing: periodic HTTPS to rare external IPs at fixed intervals
• Backup system tampering: deleted jobs, changed retention, disabled agents

Assets this gang profile historically prioritizes for exfiltration:

• Finance and HR datastores (payroll, banking details, PII) — maximum extortion leverage
• Legal/contracts and insurance policies (attackers read the policy to size the demand)
• Source code repositories and build servers for technology-sector victims (note the TeamCity KEV overlap)
• Email archives of executives for negotiation pressure

Containment actions, ordered by urgency:

1. Isolate affected segments at the switch/VLAN level — do NOT power off hosts (preserve memory evidence); network isolation first.
2. Disable compromised and suspected-compromised accounts enterprise-wide; force password reset for all privileged accounts (assume DCSync if a DC was touched).
3. Block egress to known exfil destinations at the proxy/firewall; alert on large outbound transfers in flight.
4. Snapshot and preserve memory and logs from patient-zero and domain controllers before remediation.
5. Take backups offline-verify: confirm at least one immutable, tested restore point before announcing containment.
6. Engage IR retainer and legal counsel early; if a named organization disputes a listing, document everything — disclosure obligations vary by jurisdiction.

Hardening Recommendations

Immediate (24 hours):

• Patch or mitigate all CISA KEV perimeter devices: Check Point Security Gateway (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), VMware vCenter (CVE-2026-59310), JetBrains TeamCity (CVE-2026-63077). If patching is impossible, take the interface off the internet.
• Enforce MFA on all VPN and remote access; audit for local VPN accounts that bypass IdP.
• Block macro execution from internet-sourced Office documents via GPO; enable Attack Surface Reduction rules for Office child processes.
• Disable RDP exposure to the internet (verify via external scan); require RD Gateway + MFA where RDP is business-critical.
• Restrict vssadmin/bcdedit/wmic execution to admin tiers via AppLocker or WDAC; alert on any execution.
• Deploy the Sigma rules above and run the KQL hunt across the last 14 days retroactively.

Short-term (2 weeks):

• Implement tiered administration with dedicated Privileged Access Workstations; eliminate domain admin logons to member servers and workstations.
• Deploy immutable, offline, or logically air-gapped backups with tested restore runbooks — recovery time objective is your real ransomware control.
• Segment OT-adjacent and flat networks (critical for shipyard/maritime environments); put engineering workstations and file servers behind internal firewalls.
• Stand up egress filtering with TLS inspection on server VLANs; servers should rarely initiate large outbound transfers.
• Instrument CI/CD infrastructure (TeamCity and equivalents) as tier-0 assets: isolated networks, signed artifacts, and monitoring for anomalous build-agent behavior given the current supply-chain KEV landscape (CVE-2026-48027, CVE-2026-63077).
• Establish dark-web leak-site monitoring for your organization's name and brand so criminal claims reach you in hours, not weeks.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub