Springfield Public Schools ransomware victim disclosure
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Springfield Public Schools targeted by ransomware; 174 employee accounts compromised via infostealer infections.
Springfield Public Schools has been identified as a ransomware victim, with public disclosure of a breach affecting the organization's IT infrastructure. According to the ransomware.live tracking platform, the attack involved compromise of 174 employee accounts and 74 users, with 215 third-party employee credentials exposed and 36 items identified in the organization's external attack surface. The breach appears to have been enabled by infostealer infections that preceded the ransomware deployment—a common attack chain where credential-stealing malware creates the initial foothold that ransomware operators later exploit. The disclosure includes DNS records and screenshots indicating public awareness of the incident.
Mentioned in this report
Detection guidance
Shadow Copy and Backup Deletion Consistent with Ransomware Pre-Encryption
Detects vssadmin, wmic, wbadmin or bcdedit commands that delete shadow copies or backups or disable recovery, a common step before ransomware encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shadow Copy and Backup Deletion Consistent with Ransomware Pre-Encryption
description: Detects vssadmin, wmic, wbadmin or bcdedit commands that delete volume
shadow copies or backup catalogs or disable recovery. Ransomware operators run these
just before encrypting data to prevent restoration.
tags:
- attack.impact
- attack.t1486
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_vssadmin:
Image|endswith: \vssadmin.exe
CommandLine|contains|all:
- delete
- shadows
selection_wmic:
Image|endswith: \wmic.exe
CommandLine|contains|all:
- shadowcopy
- delete
selection_wbadmin:
Image|endswith: \wbadmin.exe
CommandLine|contains|all:
- delete
- catalog
selection_bcdedit:
Image|endswith: \bcdedit.exe
CommandLine|contains|all:
- recoveryenabled
- 'no'
condition: 1 of selection_*
falsepositives:
- Backup or storage administrators intentionally purging shadow copies to reclaim
disk space
- Imaging or decommissioning scripts that reset recovery settings
level: high
id: f4fef107-e47f-574b-82cf-7aca93de13a7
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/U3ByaW5nZmllbGQgUHVibGljIFNjaG9vbHNAaW50ZXJsb2Nr
Browser Credential Store Accessed via Command Line by Non-Browser Process
Detects command lines that reference browser credential database files, as infostealers and operators do when harvesting saved passwords. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Browser Credential Store Accessed via Command Line by Non-Browser Process
description: Detects process command lines referencing browser saved-credential stores
(Chromium Login Data, Firefox logins.json or key4.db) from processes other than
the browsers themselves. This is typical of infostealer activity or hands-on credential
harvesting that precedes ransomware intrusions.
tags:
- attack.credential-access
- attack.t1555
- attack.t1555.003
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- \Google\Chrome\User Data\Default\Login Data
- \Microsoft\Edge\User Data\Default\Login Data
- \BraveSoftware\Brave-Browser\User Data\Default\Login Data
- \Mozilla\Firefox\Profiles
- logins.json
- key4.db
filter_browsers:
Image|endswith:
- \chrome.exe
- \msedge.exe
- \firefox.exe
- \brave.exe
condition: selection and not filter_browsers
falsepositives:
- Enterprise backup or profile migration scripts copying browser profiles
- Forensic or IT support tooling collecting browser profile data
level: medium
id: 3f9821c6-d90f-542f-aaf8-c2b23b9fcfcd
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/U3ByaW5nZmllbGQgUHVibGljIFNjaG9vbHNAaW50ZXJsb2Nr
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/U3ByaW5nZmllbGQgUHVibGljIFNjaG9vbHNAaW50ZXJsb2Nr
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs