VORANT. Threat Intelligence Sign in Get the full feed

Falcon group claims Globus Medical breach

elevated threat healthcaremanufacturing

An emerging ransomware/extortion group calling itself Falcon claims to have exfiltrated 2.96TB of data from medical device maker Globus Medical (NYSE: GMED).

Ransomware.live tracked a data leak claim from an emerging extortion actor identified as 'Falcon' against Globus Medical, a NYSE-listed medical device manufacturer. The threat actor claims to have exfiltrated approximately 2.96TB of data, allegedly including customer records from a Microsoft PowerBI database (over 51,000 records), FDA regulatory correspondence, 510(k) submissions, PMA approval letters, TGA suspension proposals, product complaint logs, adverse event narratives, CAPA investigation findings, merger diligence documents, FTC antitrust review materials, financial statements, board meeting minutes, executed NDAs, distribution contracts, and patient demographic/clinical registry data. As this is reported as an emerging group, the claim should be treated with caution pending independent verification.

Separately, HudsonRock infostealer telemetry associated with the victim's domain shows 12 compromised employees and 2 compromised users, along with 14 third-party employee credential exposures, suggesting a possible infostealer-related initial access vector or credential exposure risk unrelated to or contributing to the claimed breach. The external attack surface enumeration lists cloud/SaaS integrations (Adobe, Atlassian, HubSpot, Mimecast, Miro, Smartsheet, TeamViewer) via DNS TXT record verification strings, but no direct evidence of exploitation is provided in the source material.

Defenders in the healthcare and medical device manufacturing sector should note this as a potential data extortion incident involving sensitive regulatory, clinical, and financial data if verified. Given the claimed data includes patient information and regulatory submissions, organizations with similar SaaS footprints and infostealer exposure should review credential hygiene, monitor for stolen employee/session credentials, and audit third-party access to cloud platforms referenced (Adobe, Atlassian, Mimecast, etc.).

Mentioned in this report

Threat actors Falcon

Detection guidance

TeamViewer Mutex Creation Indicative of Remote Access Tool

ATT&CK T1021.002

Detects creation of TeamViewer-specific mutexes (TeamViewer_LogMutex, TeamViewer3_Win32_Instance_Mutex, TeamViewerHooks_DynamicMemMutex), indicating active TeamViewer session for potential lateral movement or credential harvesting. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: TeamViewer Mutex Creation Indicative of Remote Access Tool
description: Detects creation of TeamViewer-specific mutexes commonly associated with
  active remote access sessions. Useful for identifying unauthorized remote tool usage
  in environments where TeamViewer is not standard-approved.
tags:
- attack.lateral-movement
- attack.t1021.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_teamviewer:
    Image|endswith: \teamviewer.exe
  selection_mutex:
    CommandLine|contains:
    - TeamViewer_LogMutex
    - TeamViewer3_Win32_Instance_Mutex
    - TeamViewerHooks_DynamicMemMutex
  condition: selection_teamviewer or selection_mutex
falsepositives:
- Legitimate remote support sessions authorized by IT department
- Approved remote work using TeamViewer on corporate-managed devices
level: medium
id: b83e7060-d3a7-557e-938f-99aa09ebbac7
status: experimental
author: Vorant

Suspicious File Access to Credential Storage Locations

ATT&CK T1552.001

Detects processes accessing or reading files from common credential storage paths (user profile directories, cloud sync folders) that may indicate credential harvesting prior to exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious File Access to Credential Storage Locations
description: Detects process file read/open operations targeting credential-bearing
  file patterns in user profiles or cloud synchronization directories (AppData, OneDrive,
  Dropbox, Documents), consistent with credential harvesting prior to exfiltration.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
    - \AppData\Local\Microsoft\Credentials
    - \AppData\Roaming\Microsoft\Credentials
    - \AppData\Local\Google\Chrome\User Data
    - \AppData\Local\Mozilla\Firefox\Profiles
    - \OneDrive\
    - \Dropbox\
  selection_file_types:
    TargetFilename|endswith:
    - .txt
    - .csv
    - .json
    - .xlsx
    - .docx
  filter_system_access:
    Image|endswith:
    - \explorer.exe
    - \notepad.exe
    - \outlook.exe
  condition: selection_paths and selection_file_types and not filter_system_access
falsepositives:
- User browsing cloud sync folders or temp credential stores during normal work
- Backup/sync applications accessing credential-adjacent files for legitimate purposes
level: medium
id: 7f5adba9-b139-5c15-bebb-a4a5b1116903
status: experimental
author: Vorant

Bulk Data Transfer to Cloud Storage Service

ATT&CK T1567.002

Detects large-volume outbound HTTP/HTTPS connections to cloud storage providers (Azure, AWS S3, Google Cloud, Dropbox, OneDrive) consistent with data exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Bulk Data Transfer to Cloud Storage Service
description: Detects outbound network connections with high data volume or bulk upload
  patterns to cloud storage services, indicative of data exfiltration to cloud-hosted
  targets.
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection_cloud_storage:
    DestinationHostname|contains:
    - blob.core.windows.net
    - s3.amazonaws.com
    - storage.googleapis.com
    - dropboxapi.com
    - onedrive.live.com
  filter_legitimate_sync:
    Image|endswith:
    - \OneDrive.exe
    - \Dropbox.exe
  condition: selection_cloud_storage and not filter_legitimate_sync
falsepositives:
- Legitimate cloud backup/synchronization client activity (OneDrive, Dropbox running
  as service)
- Authorized cloud application integrations or data migration workflows
level: medium
id: 0724d259-ad64-5789-8f4a-81f7914214a5
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/R2xvYnVzIE1lZGljYWxARmFsY29u

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free