# AT&T targeted by EndZone ransomware gang

Published: 2026-09-18 · Severity: high · Sectors: telecommunications
Canonical: https://vorant.io/reports/9902876f-6554-5844-abc6-eb00b724f5ea/at-t-targeted-by-endzone-ransomware-gang

> EndZone ransomware operators claim compromise of AT&T with 121k compromised user credentials and 997 employee accounts.

Ransomware.live, a platform indexing publicly disclosed breaches, reports that the EndZone ransomware group has claimed a compromise of AT&T. The reported scope includes 997 compromised employee accounts, 121,130 compromised user credentials, 1,265 third-party employee credentials, and 200 identified external attack surface DNS records. The disclosure does not provide technical details of the intrusion vector, exploitation methods, or malware families involved. EndZone's claim appears posted on a ransomware operator disclosure site; verification of the breach scope and contents by AT&T or independent security researchers has not been independently confirmed in this article. The statistics suggest a significant credential harvesting operation, possibly facilitated by infostealer malware infections within AT&T's environment or among partner organizations, which are known precursors to ransomware deployment.

## Mentioned in this report

- Threat actors: EndZone
- Malware: EndZone

## Detection guidance (public sample)

### Browser Credential Store Files Referenced in Command Line

ATT&CK: T1555.003

Command lines that copy or read browser credential databases (Login Data, logins.json, key4.db) from Chromium or Firefox profile directories, as infostealers and post-exploitation tooling do. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Browser Credential Store Files Referenced in Command Line
description: Detects command lines that reference both a browser profile directory
  and a credential database file (Login Data, logins.json, key4.db), typical of infostealer-style
  harvesting or manual copying of browser passwords for offline decryption. The report
  gives no technical detail, so this is grounded in the mapped technique T1555.003
  rather than a described tool.
tags:
- attack.credential-access
- attack.t1555.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_profile:
    CommandLine|contains:
    - \Google\Chrome\User Data
    - \Microsoft\Edge\User Data
    - \BraveSoftware\Brave-Browser\User Data
    - \Chromium\User Data
    - \Opera Software\Opera Stable
    - \Mozilla\Firefox\Profiles
  selection_file:
    CommandLine|contains:
    - Login Data
    - logins.json
    - key4.db
  filter_browser_self:
    Image|endswith:
    - \chrome.exe
    - \msedge.exe
    - \firefox.exe
    - \brave.exe
    - \opera.exe
  condition: selection_profile and selection_file and not filter_browser_self
falsepositives:
- Browser profile backup or migration scripts run by IT
- Digital forensics or e-discovery tooling collecting browser artefacts
level: medium
id: 331def73-d99c-55c9-be5a-f8a45561777e
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/QVQmVEBFbmRab25l
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/QVQmVEBFbmRab25l

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9902876f-6554-5844-abc6-eb00b724f5ea/at-t-targeted-by-endzone-ransomware-gang.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup