# Ransomware.live reports Genesis victim with infostealer compromise

Published: 2026-05-29 · Severity: elevated
Canonical: https://vorant.io/reports/a294d793-859c-5755-a287-aee2c3f56cf0/ransomware-live-reports-genesis-victim-with-infostealer-compromise

> Genesis ransomware victim disclosed with 394 compromised users and 188 stolen third-party credentials.

Ransomware.live, a tracking platform for ransomware gang disclosures, has indexed a victim claim attributed to the Genesis ransomware operation. The victim organization appears to have experienced a compromise resulting in 394 compromised user accounts and 188 third-party employee credentials being exfiltrated. The attack surface assessment identified 3 external-facing systems. The disclosure includes a leak screenshot posted by the ransomware operator. This appears to be part of a broader pattern where infostealer infections precede ransomware deployment, as noted in the Hudson Rock sponsorship mention. The article provides no technical details about the infection vector, exploitation method, or specific systems affected beyond the summary statistics.

## Mentioned in this report

- Threat actors: genesis
- Malware: Genesis

Source reporting: https://www.ransomware.live/id/Kk0qKkBnZW5lc2lz

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a294d793-859c-5755-a287-aee2c3f56cf0/ransomware-live-reports-genesis-victim-with-infostealer-compromise.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup