# David King Architect compromised in infostealer-to-ransomware chain

Published: 2026-08-06 · Severity: routine
Canonical: https://vorant.io/reports/26ca945a-2742-5544-9c67-3f2004a09d44/david-king-architect-compromised-in-infostealer-to-ransomware-chain

> David King Architect exposed via infostealer infection affecting 7656 users, with 5 third-party credentials compromised and potential ransomware risk.

Ransomware.live has indexed a public post by ransomware operators indicating compromise of David King Architect (Orova). The breach involved infostealer malware that captured credentials from 7656 user accounts and 5 third-party employee credentials. The attack surface assessment identified 100 external-facing DNS records. This represents a typical infostealer-to-ransomware infection chain where initial compromise via info-stealing malware creates conditions for follow-on ransomware deployment. The disclosure indicates operators have exfiltrated data and are publicly signaling the compromise, creating urgency for affected parties and downstream organizations using David King Architect services.

## Mentioned in this report

- Malware: Infostealer

## Detection guidance (public sample)

### Non-Browser Command Line Accessing Browser Credential Store Files

ATT&CK: T1555.003

Command shells or copy utilities referencing browser credential databases (Login Data, logins.json, key4.db), as used by infostealers to harvest saved browser passwords. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Non-Browser Command Line Accessing Browser Credential Store Files
description: Detects cmd, PowerShell or file-copy utilities referencing browser credential
  databases such as Chromium Login Data and Firefox logins.json/key4.db. Infostealers
  and their operators copy these files to harvest saved passwords. Generalises on
  the file and utility pattern, not any specific stealer family.
tags:
- attack.credential-access
- attack.t1555.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \esentutl.exe
    - \xcopy.exe
    - \robocopy.exe
    - \certutil.exe
  selection_target:
    CommandLine|contains:
    - \Google\Chrome\User Data\Default\Login Data
    - \Microsoft\Edge\User Data\Default\Login Data
    - \BraveSoftware\Brave-Browser\User Data\Default\Login Data
    - \Mozilla\Firefox\Profiles
    - logins.json
    - key4.db
  condition: selection_img and selection_target
falsepositives:
- Browser profile backup or migration scripts run by IT staff
- Forensic or endpoint backup tools that copy user profiles via the command line
level: medium
id: e1b56cab-a035-5970-9589-8e1e1845e005
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RGF2aWQgS2luZyBBcmNoaXRlY3RAT3JvdmE=
```

### Ransomware Precursor Backup and Shadow Copy Destruction

ATT&CK: T1486

Deletion of volume shadow copies, backup catalogs or disabling of recovery options, a typical step before ransomware encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Ransomware Precursor Backup and Shadow Copy Destruction
description: Detects commands that delete volume shadow copies or backup catalogs,
  or disable Windows recovery, which commonly precede ransomware encryption in infostealer-to-ransomware
  chains.
tags:
- attack.impact
- attack.t1486
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_wbadmin:
    Image|endswith: \wbadmin.exe
    CommandLine|contains|all:
    - delete
    - catalog
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains:
    - recoveryenabled no
    - bootstatuspolicy ignoreallfailures
  condition: 1 of selection_*
falsepositives:
- Backup or storage maintenance scripts that purge old shadow copies
- Administrators reclaiming disk space with vssadmin
level: high
id: 2882dcda-72a6-5d64-a48d-bfd1b59b0a6a
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/RGF2aWQgS2luZyBBcmNoaXRlY3RAT3JvdmE=
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/RGF2aWQgS2luZyBBcmNoaXRlY3RAT3JvdmE=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/26ca945a-2742-5544-9c67-3f2004a09d44/david-king-architect-compromised-in-infostealer-to-ransomware-chain.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup