VORANT. Threat Intelligence Research Sign in Create a free account

Ransomware.live reports Genesis victim with infostealer compromise

elevated threat

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Genesis ransomware victim disclosed with 394 compromised users and 188 stolen third-party credentials.

Ransomware.live, a tracking platform for ransomware gang disclosures, has indexed a victim claim attributed to the Genesis ransomware operation. The victim organization appears to have experienced a compromise resulting in 394 compromised user accounts and 188 third-party employee credentials being exfiltrated. The attack surface assessment identified 3 external-facing systems. The disclosure includes a leak screenshot posted by the ransomware operator. This appears to be part of a broader pattern where infostealer infections precede ransomware deployment, as noted in the Hudson Rock sponsorship mention. The article provides no technical details about the infection vector, exploitation method, or specific systems affected beyond the summary statistics.

Mentioned in this report

Threat actors genesis
Malware Genesis

Source reporting: https://www.ransomware.live/id/Kk0qKkBnZW5lc2lz

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account   What it costs