Ransomware Group intelligence
Whitearmor
ActiveTrack Whitearmor with 14 published victims and 1 known leak locations in a single intelligence view.
DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Whitearmor is tracked by Dark Eye as a ransomware group with 14 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
14
- Leaked 7 50.0%
- Pending 7 50.0%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 1h ago | whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion |
Top Activity Sectors (7)
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Whitearmor, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: Whitearmor executes malicious payloads through PowerShell scripts to deploy ransomware and evade detection.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: Whitearmor adds malicious registry run keys to ensure ransomware reactivation after system reboots.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Whitearmor disables security tools by terminating antivirus processes and modifying Windows Defender settings.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027 Obfuscated Files or Information Stealth
What they do: Whitearmor obfuscates ransomware binaries using custom packing tools to evade signature-based detection.
What that means: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
-
T1070.004 File Deletion Stealth
What they do: Whitearmor deletes Volume Shadow Copies and backup directories via vssadmin to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1083 File and Directory Discovery Discovery
What they do: Whitearmor uses file and directory discovery via PowerShell to enumerate critical system and data folders before encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1560.001 Archive via Utility Collection
What they do: Whitearmor archives stolen data using built-in utility commands before exfiltration via encrypted channels.
What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
-
T1485 Data Destruction Impact
What they do: Whitearmor performs targeted data destruction of engineering databases and manufacturing logs to maximize operational disruption.
What that means: Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
-
T1486 Data Encrypted for Impact Impact
What they do: Whitearmor encrypts victim files using custom ransomware binaries targeting business documents and engineering data.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: Whitearmor halts system recovery processes by stopping critical Windows services like backup and monitoring utilities.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (14)
Search, filter and paginate the victim timeline for Whitearmor. Showing 1–14 of 14.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | KTU Shipyard id35981 View details | Türkiye | Manufacturing / Engineering | pending | ||
|
KTU Shipyard 10/30/2026 08:02 PM Company: PT Karya Teknik Utama (KTU Shipyard) Location: Batam, Indonesia Founded: 1982 Industry: Shipbuilding & Marine Engineering Website: https://ktushipyard.com/ What the company does KTU Shipyard is an Indonesian shipbuilding company specializing in the construction, repair and maintenance of commercial vessels. Its main products and services include: - Tugboats - Barges - Tankers and cargo vessels - Crane barges - Ship repair and maintenance Company size - Privately owned company. - Approximately 501–1,000 employees. - Multiple shipyard facilities in Indonesia. - Claims to have built approximately 2,200 vessels. Annual Revenue ~USD 200 million Key Business Information - Business model: B2B shipbuilding and marine services. - Customers: Shipping companies, marine logistics operators and offshore businesses. - Main market: Indonesia and regional maritime markets. - Competitive advantage: Established shipbuilding experience, multiple facilities and diverse vessel manufacturing capabilities. What was accessed: Internal ticketing systems, All users drive (including business, customer, confidential files over 3tb of data), customer data, etc. You have 20 days to reach out or let it be your downfall. Attatched: Is a sample file from recent user drives, and a screenshot showing POA (proof of access) We can be very reasonable and this can go well or it can not. You can start contact at the email: [email protected] https://gofile.io/d/G981x5Rl https://gofile.io/d/99sTtibR (backup sample files) 19d 23:44:21 UNTIL RELEASE 2 FILE(S) 10 |
||||||
| Ransomware | rolly.io id35944 View details | United States | IT | pending | ||
|
rolly.io 10/29/2026 05:51 PM Rolly.io is an on-chain crypto casino on Arbitrum featuring a public bankroll, transparent bonus formulas (rakeback, weekly bonuses), and active player reward systems. We hold 1,364 rolly.gg player PII records with linked on-chain wallets, 430K+ ledger transactions, 11,442 wallet addresses, 155 whale payout maps, 299 deanonymized staff/CTO emails, and 313 internal chat messages. We aren't asking for any ransom, we just thought it was funny to hack a casino that made a joke about Gamdom. 2 FILE(S) 15 |
||||||
| Ransomware | Echo.com id35843 View details | Germany | Retail / E-commerce | leaked | ||
|
Echo.com 10/28/2026 01:05 AM Echo Global Logistics is a Chicago-based, technology-enabled third-party logistics provider offering freight brokerage and integrated supply chain services, including truckload, LTL, warehousing, and cross-border shipping across North America. We hold Echo Global Logistics data: 2.06M claims rows, 153,727 freight loads, 261,440 quotes ($705M buy volume), 136,273 tenderings, 59,607 tracking records, 3,890 employee identity mappings with emails, 2,418 customers, 9,122 carriers, and warehouse geodata. We suggest you pay a small ransom demand of $10,000,000 in BTC and move on with your lives. Emails with instructions will be sent to you shortly. Samples can be found below. Contact: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: [email protected] 18d 22:21:01 UNTIL RELEASE 2 FILE(S) 301 |
||||||
| Ransomware | Ryder id35841 View details | United States | Transportation / Travel / Logistics | leaked | ||
|
Ryder is a Fortune 500 transportation and supply chain management company providing fleet management, dedicated transportation, and logistics solutions. What we hold: 18.75M rows, 328 CSVs, consumer names, phones, emails, driver/associate PII, cleartext API keys, LMS credentials, FTP/telematics configs from RyderView, RLM, EFT. Our demand is only $20M in BTC... i swear. Samples can be found below. Emails with instructions will be sent to Ryder shortly, and no we did not buy access from 'shadowbyte' or whatever the niggas name is on pwnforums. Contact if you do not receive the instructions: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: [email protected] |
||||||
| Ransomware | https://t.me/whitearmorxd id35840 View details | — | Other | pending | ||
|
Hi, join our telegram channel for fun.. i guess [Telegram link: professional/enterprise only] |
||||||
| Ransomware | gamblinglore id35813 View details | United States | Services | pending | ||
|
gamblinglore 10/27/2026 01:35 AM Verification for Gamblinglore.com VIEW POST 448 |
||||||
| Ransomware | Gamdom id35793 View details | United States | IT | leaked | ||
|
Gamdom 10/26/2026 04:45 PM Gamdom is an unregulated crypto casino and sportsbook founded in 2016. It recently suffered a hot-wallet breach, with founder Felix Romer reporting over $3 million in losses, though on-chain analysts estimate the damage closer to $4.2 million. We hold Gamdom's full user database, 15,420,003 accounts with 146 columns, with Gamdom's total combined profit value exceeding $1 billion. The way in was something internal, a machine account that was already sitting in their admin side (Metawin). Issued years back, nobody ever rotated it. Never meant to leave the building. It had admin reach, and everything after that was their own stuff anyway, their control panels and secret stores. About your provably fair: what it promised and what it delivered were never the same thing. We demand $15,000,000 in BTC. Emails with instructions will be sent to you directly. To verify, a sample can be found below. 11d 14:44:22 UNTIL RELEASE 1 FILE(S) 544 |
||||||
| Ransomware | LoveSac id35571 View details | United States | Retail / E-commerce | leaked | ||
|
LoveSac (LOVE) is a premium furniture retailer operating more than 250 showrooms across the United States, generating approximately $700 million in annual revenue. We have obtained a database containing 1,113,285 order records spanning nearly seven years of transactions, from December 2019 through October 2026, with a combined recorded transaction value exceeding $1.62 billion. Each record contains detailed customer and transaction information, including full customer names, complete billing and shipping addresses, telephone numbers, order numbers, order dates, order statuses, and order grand totals. Our demand: $500,000 in BTC or XMR To verify, samples can be found below. |
||||||
| Ransomware | J.B Hunt id35568 View details | United States | Transportation / Travel / Logistics | leaked | ||
|
You are so stupid JB Hunt. Instead of getting in contact with us & starting the negotiation process, not only did you not announce the breach, you silently email customers demanding them to update their passwords.. Fuck you... ;/ |
||||||
| Ransomware | https://x.com/WhiteArmorxd id35563 View details | — | null | pending | ||
|
Hi, we now have an X account. https://x.com/WhiteArmorxd Also, fuck the AI slop cti reporters lol |
||||||
| Ransomware | Hisense id35543 View details | China | Manufacturing / Engineering | leaked | ||
|
Hisense is a Chinese multinational electronics and appliance manufacturer, founded in 1969, known globally for televisions and home appliances. We hold Hisense's entire GCRM production document store, the full warranty-claims archive for Malaysia/Singapore: customer names, phones, emails, ID numbers, 2,549 suppliers, hundreds of invoices, payments, contracts, RMA forms, claim evidence, plus their internal CRM app binary. Our demand is $500,000 in BTC. Good luck. Contact: [email protected] Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 |
||||||
| Ransomware | whitearmor.cc id35484 View details | Cocos (Keeling) Islands | Services | pending | ||
|
Hi! We now have a clearnet domain for easy-access. WhiteArmor.cc |
||||||
| Ransomware | Whirlpool id35479 View details | United States | Manufacturing / Engineering | pending | ||
|
Whirlpool is a global home appliance manufacturer (NYSE: WHR) making washers, fridges, and cooking appliances under brands like KitchenAid and Maytag. Its 2025 annual revenue was about $15.52 billion. We hold 4,577 Whirlpool employee records across three plants, names, AD-style usernames, managers, cost centers, shifts, along with 374 corporate emails, ~22,000 SAP invoice records, and the full plant contact infrastructure. Pay, and this stays quiet. Don't, and the data goes public. We want $140,000 in BTC or XMR. You will receive an email containing instructions on how to proceed. Samples: https://biteblob.com/Information/mNTP6w0lBW8P9l/#samples.zip Contact: [email protected] Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 |
||||||
| Ransomware | JB Hunt id35480 View details | United States | Retail / E-commerce | leaked | ||
|
J.B. Hunt is a major North American transportation and logistics company providing intermodal, dedicated, and truckload services via its digital freight marketplace. We hold 140,838 employee records with PII and national IDs, 1.7M carrier contacts, 38.2M invoices, 187K RBAC permission records, 3,196 ranked account-takeover targets, 973 M365 mailboxes, 374K organizations. Our demand: $5,000,000, in BTC or XMR. Instructions to follow by email. To verify, samples can be found below. Contact: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: [email protected] |
||||||