OnTrac employee data extorted by Emperador
Free public brief. The indicators, the detections with Splunk and KQL already written, and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Extortion actor 'emperador' claims theft of 197k OnTrac employee records and demands $1M or will leak the data.
Ransomware.live's leak-site tracker recorded a new victim posting attributed to an extortion actor/group using the alias "emperador," targeting OnTrac, a major U.S. last-mile delivery company formed from the 2021 LaserShip/OnTrac merger. The actor claims to hold a full employee database of approximately 197,000 records containing extensive PII — names, employee/legal-entity identifiers, hire dates, home/mobile/business phone numbers, personal and business email addresses, social media handles, and physical/mailing addresses.
The posting includes a $1,000,000 extortion demand, a threat to publicly post the data if unpaid, and a threat to directly target OnTrac's partners and employees for further pressure. The actor references contact via a messaging session ID and email addresses, and notes that extortion emails were already sent to multiple ontrac.com addresses, indicating direct outreach to employees as a pressure tactic alongside the leak-site posting.
No technical details of the initial intrusion vector, malware used, or encryption activity are provided in this posting — it reads as a data-theft/extortion claim rather than confirmed ransomware deployment. Defenders at OnTrac and its partners should treat this as a credible data-breach claim pending verification, monitor for phishing/social-engineering attempts referencing this incident targeting employees, reset credentials and monitor for use of exposed PII (especially personal emails and phone numbers) in follow-on attacks, and watch for the data appearing on leak sites if the ransom is not paid.
Mentioned in this report
Detection guidance
Exfiltration of Employee Database via Web Service
Detects large data transfers to external web services or cloud storage platforms that may indicate exfiltration of employee records or PII databases. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Exfiltration of Employee Database via Web Service
description: Detects network connections from internal systems to external web services
(file-hosting, cloud storage, messaging platforms) with large data transfers, indicative
of employee database exfiltration. Generalises on destination port, protocol, and
transfer patterns rather than specific URLs or threat actor infrastructure.
tags:
- attack.exfiltration
- attack.t1567
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort:
- 80
- 443
- 8080
- 8443
Protocol: tcp
filter_known_legitimate:
Image|endswith:
- \chrome.exe
- \firefox.exe
- \iexplore.exe
- \msedge.exe
DestinationHostname|endswith:
- .microsoft.com
- .google.com
- .apple.com
- .windows.net
condition: selection and not filter_known_legitimate
falsepositives:
- Legitimate cloud backup and sync services (OneDrive, Dropbox, Google Drive) used
by employees
- Software updates and patch distribution over HTTPS
level: low
id: b93e5975-d8dc-581e-96fc-8d636f358c00
status: experimental
author: Vorant
Reconnaissance of Organizational Structure via Directory Services
Detects queries to Active Directory or LDAP services enumerating employee information, groups, and organizational structure — typical precursor to targeted data theft and phishing campaigns. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reconnaissance of Organizational Structure via Directory Services
description: Detects LDAP/Active Directory enumeration queries targeting employee
objects, phone numbers, email addresses, or organizational group membership. Generalises
on LDAP filter patterns and query scope rather than specific user names or departments.
tags:
- attack.reconnaissance
- attack.t1591
logsource:
category: network_connection
product: windows
detection:
selection_ldap:
DestinationPort: 389
Protocol: tcp
selection_ldap_filter:
CommandLine|contains:
- objectClass=person
- mail=
- telephoneNumber
- memberOf
- cn=Users
filter_admin_tools:
Image|endswith:
- \adsiedit.msc
- \ldp.exe
- \dsquery.exe
condition: (selection_ldap or selection_ldap_filter) and not filter_admin_tools
falsepositives:
- Active Directory administrative tools (ADSI Edit, LDP, dsquery) used by IT support
staff
- Directory synchronization services and identity management platforms
level: medium
id: 425baeae-a9d6-5937-a048-86e3e2d1b1a6
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/T25UcmFjQGVtcGVyYWRvcg==
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections with the Splunk SPL and Microsoft KQL already written, the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 9,709 reports from 155 sources, 1,526 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs