David King Architect compromised in infostealer-to-ransomware chain

6 August 2026 routine threat

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

David King Architect exposed via infostealer infection affecting 7656 users, with 5 third-party credentials compromised and potential ransomware risk.

Ransomware.live has indexed a public post by ransomware operators indicating compromise of David King Architect (Orova). The breach involved infostealer malware that captured credentials from 7656 user accounts and 5 third-party employee credentials. The attack surface assessment identified 100 external-facing DNS records. This represents a typical infostealer-to-ransomware infection chain where initial compromise via info-stealing malware creates conditions for follow-on ransomware deployment. The disclosure indicates operators have exfiltrated data and are publicly signaling the compromise, creating urgency for affected parties and downstream organizations using David King Architect services.

Mentioned in this report

Malware Infostealer

Detection guidance

Non-Browser Command Line Accessing Browser Credential Store Files

ATT&CK T1555.003

Command shells or copy utilities referencing browser credential databases (Login Data, logins.json, key4.db), as used by infostealers to harvest saved browser passwords. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Non-Browser Command Line Accessing Browser Credential Store Files
description: Detects cmd, PowerShell or file-copy utilities referencing browser credential
  databases such as Chromium Login Data and Firefox logins.json/key4.db. Infostealers
  and their operators copy these files to harvest saved passwords. Generalises on
  the file and utility pattern, not any specific stealer family.
tags:
- attack.credential-access
- attack.t1555.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \esentutl.exe
    - \xcopy.exe
    - \robocopy.exe
    - \certutil.exe
  selection_target:
    CommandLine|contains:
    - \Google\Chrome\User Data\Default\Login Data
    - \Microsoft\Edge\User Data\Default\Login Data
    - \BraveSoftware\Brave-Browser\User Data\Default\Login Data
    - \Mozilla\Firefox\Profiles
    - logins.json
    - key4.db
  condition: selection_img and selection_target
falsepositives:
- Browser profile backup or migration scripts run by IT staff
- Forensic or endpoint backup tools that copy user profiles via the command line
level: medium
id: e1b56cab-a035-5970-9589-8e1e1845e005
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RGF2aWQgS2luZyBBcmNoaXRlY3RAT3JvdmE=

Ransomware Precursor Backup and Shadow Copy Destruction

ATT&CK T1486

Deletion of volume shadow copies, backup catalogs or disabling of recovery options, a typical step before ransomware encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Ransomware Precursor Backup and Shadow Copy Destruction
description: Detects commands that delete volume shadow copies or backup catalogs,
  or disable Windows recovery, which commonly precede ransomware encryption in infostealer-to-ransomware
  chains.
tags:
- attack.impact
- attack.t1486
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_wbadmin:
    Image|endswith: \wbadmin.exe
    CommandLine|contains|all:
    - delete
    - catalog
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains:
    - recoveryenabled no
    - bootstatuspolicy ignoreallfailures
  condition: 1 of selection_*
falsepositives:
- Backup or storage maintenance scripts that purge old shadow copies
- Administrators reclaiming disk space with vssadmin
level: high
id: 2882dcda-72a6-5d64-a48d-bfd1b59b0a6a
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RGF2aWQgS2luZyBBcmNoaXRlY3RAT3JvdmE=

1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/RGF2aWQgS2luZyBBcmNoaXRlY3RAT3JvdmE=

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs