Electrolux exposed in emperador ransomware group claim
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Electrolux targeted by emperador ransomware group; 736 compromised user credentials and exposed external attack surface.
Ransomware.live, a public tracking platform that indexes ransomware operator disclosures, reports that Electrolux appears on the emperador ransomware group's victim listing. The group claims compromised credentials for 736 users and has identified 17 points on the victim's external attack surface. The listing indicates data exfiltration ahead of threatened encryption, a standard tactic in extortion-based ransomware campaigns. No employee credentials from Electrolux staff were listed as compromised in the disclosure. The claim is indexed from publicly visible information posted by the ransomware operator and does not constitute confirmation of active compromise or successful encryption.
Mentioned in this report
Source reporting: https://www.ransomware.live/id/RWxlY3Ryb2x1eEBlbXBlcmFkb3I=
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs