# PChome Taiwan hit by ransomware operators

Published: 2026-06-28 · Severity: routine · Sectors: retail, technology
Canonical: https://vorant.io/reports/0dd4fb4a-f414-59b5-a962-ebcc142e4c77/pchome-taiwan-hit-by-ransomware-operators

> Ransomware operators claim compromise of PChome.com.tw with thousands of employee and user credentials exposed.

Ransomware.live, a ransomware tracking platform, reports that PChome.com.tw—a major Taiwanese e-commerce platform—has been compromised. According to the operator's claim, the breach resulted in exfiltration of credentials belonging to 3,242 employees, 32,063 users, and 3,785 third-party employee accounts. The attackers also identified 187 external attack surface records and extracted DNS configuration data. The article itself does not name a specific ransomware family or confirm the veracity of the claim, only that it has been indexed from public ransomware operator posts. No technical indicators of compromise, exploitation methodology, or active ransom demand details are disclosed beyond credential counts.

## Mentioned in this report

- Malware: Unknown ransomware

## Detection guidance (public sample)

### Network Packet Capture Tool Execution on Windows

ATT&CK: T1040

Detects packet capture via netsh trace, pktmon or standalone sniffers (tshark, dumpcap, windump, rawcap), which can be used to harvest credentials from network traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Network Packet Capture Tool Execution on Windows
description: Detects execution of packet capture utilities on Windows hosts, namely
  netsh trace with capture enabled, pktmon start, and standalone sniffers such as
  tshark, dumpcap, windump and rawcap. Attackers use these to sniff credentials from
  network traffic. The source report gives no technical detail, so this rule is based
  on the mapped technique T1040 and needs tuning against admin and network-troubleshooting
  baselines.
tags:
- attack.credential-access
- attack.discovery
- attack.t1040
logsource:
  category: process_creation
  product: windows
detection:
  selection_netsh:
    Image|endswith: \netsh.exe
    CommandLine|contains|all:
    - trace
    - start
    - capture=yes
  selection_pktmon:
    Image|endswith: \pktmon.exe
    CommandLine|contains: start
  selection_tools:
    Image|endswith:
    - \tshark.exe
    - \dumpcap.exe
    - \windump.exe
    - \rawcap.exe
  condition: 1 of selection_*
falsepositives:
- Network or helpdesk engineers capturing traffic to troubleshoot connectivity
- Wireshark installations used by IT or security staff on analyst workstations
level: medium
id: a3532b4d-9913-591f-9eb3-5a37e4eda168
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/cGNob21lLmNvbS50d0BzZXR0cmE=
```

### Packet Capture Written to File on Linux via tcpdump or tshark

ATT&CK: T1040

Detects tcpdump, tshark or dumpcap on Linux writing captured traffic to a file, which can indicate credential sniffing on a compromised server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Packet Capture Written to File on Linux via tcpdump or tshark
description: Detects tcpdump, tshark or dumpcap run on Linux with a write-to-file
  option, indicating traffic is being saved for later review or exfiltration. This
  may indicate credential sniffing on a compromised server. The source report gives
  no technical detail, so this rule is based on the mapped technique T1040.
tags:
- attack.credential-access
- attack.discovery
- attack.t1040
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
    - /tcpdump
    - /tshark
    - /dumpcap
  selection_write:
    CommandLine|contains:
    - ' -w '
    - ' --write'
  condition: selection_img and selection_write
falsepositives:
- Network engineers capturing traffic for troubleshooting
- Scheduled capture jobs run by monitoring or IDS tooling
level: medium
id: 293edbc3-efd1-5555-b816-d0cea779538b
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/cGNob21lLmNvbS50d0BzZXR0cmE=
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/cGNob21lLmNvbS50d0BzZXR0cmE=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0dd4fb4a-f414-59b5-a962-ebcc142e4c77/pchome-taiwan-hit-by-ransomware-operators.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup