PChome Taiwan hit by ransomware operators
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Ransomware operators claim compromise of PChome.com.tw with thousands of employee and user credentials exposed.
Ransomware.live, a ransomware tracking platform, reports that PChome.com.tw—a major Taiwanese e-commerce platform—has been compromised. According to the operator's claim, the breach resulted in exfiltration of credentials belonging to 3,242 employees, 32,063 users, and 3,785 third-party employee accounts. The attackers also identified 187 external attack surface records and extracted DNS configuration data. The article itself does not name a specific ransomware family or confirm the veracity of the claim, only that it has been indexed from public ransomware operator posts. No technical indicators of compromise, exploitation methodology, or active ransom demand details are disclosed beyond credential counts.
Mentioned in this report
Detection guidance
Network Packet Capture Tool Execution on Windows
Detects packet capture via netsh trace, pktmon or standalone sniffers (tshark, dumpcap, windump, rawcap), which can be used to harvest credentials from network traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Network Packet Capture Tool Execution on Windows
description: Detects execution of packet capture utilities on Windows hosts, namely
netsh trace with capture enabled, pktmon start, and standalone sniffers such as
tshark, dumpcap, windump and rawcap. Attackers use these to sniff credentials from
network traffic. The source report gives no technical detail, so this rule is based
on the mapped technique T1040 and needs tuning against admin and network-troubleshooting
baselines.
tags:
- attack.credential-access
- attack.discovery
- attack.t1040
logsource:
category: process_creation
product: windows
detection:
selection_netsh:
Image|endswith: \netsh.exe
CommandLine|contains|all:
- trace
- start
- capture=yes
selection_pktmon:
Image|endswith: \pktmon.exe
CommandLine|contains: start
selection_tools:
Image|endswith:
- \tshark.exe
- \dumpcap.exe
- \windump.exe
- \rawcap.exe
condition: 1 of selection_*
falsepositives:
- Network or helpdesk engineers capturing traffic to troubleshoot connectivity
- Wireshark installations used by IT or security staff on analyst workstations
level: medium
id: a3532b4d-9913-591f-9eb3-5a37e4eda168
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/cGNob21lLmNvbS50d0BzZXR0cmE=
Packet Capture Written to File on Linux via tcpdump or tshark
Detects tcpdump, tshark or dumpcap on Linux writing captured traffic to a file, which can indicate credential sniffing on a compromised server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Packet Capture Written to File on Linux via tcpdump or tshark
description: Detects tcpdump, tshark or dumpcap run on Linux with a write-to-file
option, indicating traffic is being saved for later review or exfiltration. This
may indicate credential sniffing on a compromised server. The source report gives
no technical detail, so this rule is based on the mapped technique T1040.
tags:
- attack.credential-access
- attack.discovery
- attack.t1040
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith:
- /tcpdump
- /tshark
- /dumpcap
selection_write:
CommandLine|contains:
- ' -w '
- ' --write'
condition: selection_img and selection_write
falsepositives:
- Network engineers capturing traffic for troubleshooting
- Scheduled capture jobs run by monitoring or IDS tooling
level: medium
id: 293edbc3-efd1-5555-b816-d0cea779538b
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/cGNob21lLmNvbS50d0BzZXR0cmE=
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/cGNob21lLmNvbS50d0BzZXR0cmE=
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs