AT&T targeted by EndZone ransomware gang

18 September 2026 high threat telecommunications

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

EndZone ransomware operators claim compromise of AT&T with 121k compromised user credentials and 997 employee accounts.

Ransomware.live, a platform indexing publicly disclosed breaches, reports that the EndZone ransomware group has claimed a compromise of AT&T. The reported scope includes 997 compromised employee accounts, 121,130 compromised user credentials, 1,265 third-party employee credentials, and 200 identified external attack surface DNS records. The disclosure does not provide technical details of the intrusion vector, exploitation methods, or malware families involved. EndZone's claim appears posted on a ransomware operator disclosure site; verification of the breach scope and contents by AT&T or independent security researchers has not been independently confirmed in this article. The statistics suggest a significant credential harvesting operation, possibly facilitated by infostealer malware infections within AT&T's environment or among partner organizations, which are known precursors to ransomware deployment.

Mentioned in this report

Threat actors EndZone

Malware EndZone

Detection guidance

Browser Credential Store Files Referenced in Command Line

ATT&CK T1555.003

Command lines that copy or read browser credential databases (Login Data, logins.json, key4.db) from Chromium or Firefox profile directories, as infostealers and post-exploitation tooling do. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Browser Credential Store Files Referenced in Command Line
description: Detects command lines that reference both a browser profile directory
  and a credential database file (Login Data, logins.json, key4.db), typical of infostealer-style
  harvesting or manual copying of browser passwords for offline decryption. The report
  gives no technical detail, so this is grounded in the mapped technique T1555.003
  rather than a described tool.
tags:
- attack.credential-access
- attack.t1555.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_profile:
    CommandLine|contains:
    - \Google\Chrome\User Data
    - \Microsoft\Edge\User Data
    - \BraveSoftware\Brave-Browser\User Data
    - \Chromium\User Data
    - \Opera Software\Opera Stable
    - \Mozilla\Firefox\Profiles
  selection_file:
    CommandLine|contains:
    - Login Data
    - logins.json
    - key4.db
  filter_browser_self:
    Image|endswith:
    - \chrome.exe
    - \msedge.exe
    - \firefox.exe
    - \brave.exe
    - \opera.exe
  condition: selection_profile and selection_file and not filter_browser_self
falsepositives:
- Browser profile backup or migration scripts run by IT
- Digital forensics or e-discovery tooling collecting browser artefacts
level: medium
id: 331def73-d99c-55c9-be5a-f8a45561777e
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/QVQmVEBFbmRab25l

1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/QVQmVEBFbmRab25l

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs