Four Hands LLC Listed as Ransomware Victim
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Ransomware.live lists furniture company Four Hands LLC as a victim, with compromised credentials and employee data exposed per a leak-site entry.
This is a brief victim-notification entry from Ransomware.live, a tracking platform that aggregates publicly posted claims from ransomware operators' leak sites. The entry identifies Four Hands LLC (listed under the UmBra ransomware group's victim index) as having compromised data, including 6 compromised employees, 156 compromised users, and 2 third-party employee credential sets, along with 21 external attack surface findings and DNS records for the victim's domain.
The article itself provides no technical details about the intrusion vector, ransomware variant behavior, ransom demands, or specific data exfiltrated — it is a minimal aggregator listing rather than original research or incident analysis. No indicators of compromise, exploited vulnerabilities, or TTPs are described. The mention of Hudson Rock's infostealer intelligence tools in the sponsorship suggests credential theft via infostealer malware may be a contributing factor in the broader threat landscape of ransomware access, but this is not explicitly tied to the Four Hands incident.
Defenders at Four Hands LLC or affiliated third parties should treat this as a notification to investigate potential credential compromise, review exposed external attack surface, and monitor for data leak disclosure from the named ransomware group (UmBra). Organizations more broadly should consider infostealer-driven credential theft as a precursor risk to ransomware and ensure credential hygiene and dark web/leak monitoring are in place.
Mentioned in this report
Source reporting: https://www.ransomware.live/id/Rm91ciBIYW5kcyBMTENAVW1CcmE=
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs