# L3Harris breached, credentials leaked by Kyber ransomware

Published: 2026-07-30 · Severity: routine · Sectors: defense, technology
Canonical: https://vorant.io/reports/14353c1a-4a4f-5072-82ff-d8ef56ffed2f/l3harris-breached-credentials-leaked-by-kyber-ransomware

> Kyber ransomware operators claim breach of L3Harris with 112 compromised users and 55 third-party employee credentials exposed.

Ransomware.live, a public tracking platform, reports that Kyber ransomware operators claim responsibility for a breach affecting L3Harris Technologies. The reported compromise involves 112 compromised users, 11 compromised employees, and 55 third-party employee credentials. The attackers also identified 38 points on the victim's external attack surface and collected DNS records from L3Harris's domain infrastructure. This represents a significant credential theft incident that could enable lateral movement and supply-chain targeting through compromised third-party credentials. The breach underscores the threat posed by infostealer malware infections leading to ransomware deployment against critical defense contractors.

## Mentioned in this report

- Threat actors: Kyber
- Malware: Kyber

1 detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/TDNIQVJSSVNAa3liZXI=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/14353c1a-4a4f-5072-82ff-d8ef56ffed2f/l3harris-breached-credentials-leaked-by-kyber-ransomware.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup