# Springfield Public Schools ransomware victim disclosure

Published: 2026-09-15 · Severity: routine · Sectors: education
Canonical: https://vorant.io/reports/c84d7bd5-4dea-5f34-a1ff-7b34892236b7/springfield-public-schools-ransomware-victim-disclosure

> Springfield Public Schools targeted by ransomware; 174 employee accounts compromised via infostealer infections.

Springfield Public Schools has been identified as a ransomware victim, with public disclosure of a breach affecting the organization's IT infrastructure. According to the ransomware.live tracking platform, the attack involved compromise of 174 employee accounts and 74 users, with 215 third-party employee credentials exposed and 36 items identified in the organization's external attack surface. The breach appears to have been enabled by infostealer infections that preceded the ransomware deployment—a common attack chain where credential-stealing malware creates the initial foothold that ransomware operators later exploit. The disclosure includes DNS records and screenshots indicating public awareness of the incident.

## Mentioned in this report

- Malware: Infostealer, Ransomware

## Detection guidance (public sample)

### Shadow Copy and Backup Deletion Consistent with Ransomware Pre-Encryption

ATT&CK: T1486

Detects vssadmin, wmic, wbadmin or bcdedit commands that delete shadow copies or backups or disable recovery, a common step before ransomware encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shadow Copy and Backup Deletion Consistent with Ransomware Pre-Encryption
description: Detects vssadmin, wmic, wbadmin or bcdedit commands that delete volume
  shadow copies or backup catalogs or disable recovery. Ransomware operators run these
  just before encrypting data to prevent restoration.
tags:
- attack.impact
- attack.t1486
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_wbadmin:
    Image|endswith: \wbadmin.exe
    CommandLine|contains|all:
    - delete
    - catalog
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains|all:
    - recoveryenabled
    - 'no'
  condition: 1 of selection_*
falsepositives:
- Backup or storage administrators intentionally purging shadow copies to reclaim
  disk space
- Imaging or decommissioning scripts that reset recovery settings
level: high
id: f4fef107-e47f-574b-82cf-7aca93de13a7
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/U3ByaW5nZmllbGQgUHVibGljIFNjaG9vbHNAaW50ZXJsb2Nr
```

### Browser Credential Store Accessed via Command Line by Non-Browser Process

ATT&CK: T1555

Detects command lines that reference browser credential database files, as infostealers and operators do when harvesting saved passwords. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Browser Credential Store Accessed via Command Line by Non-Browser Process
description: Detects process command lines referencing browser saved-credential stores
  (Chromium Login Data, Firefox logins.json or key4.db) from processes other than
  the browsers themselves. This is typical of infostealer activity or hands-on credential
  harvesting that precedes ransomware intrusions.
tags:
- attack.credential-access
- attack.t1555
- attack.t1555.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
    - \Google\Chrome\User Data\Default\Login Data
    - \Microsoft\Edge\User Data\Default\Login Data
    - \BraveSoftware\Brave-Browser\User Data\Default\Login Data
    - \Mozilla\Firefox\Profiles
    - logins.json
    - key4.db
  filter_browsers:
    Image|endswith:
    - \chrome.exe
    - \msedge.exe
    - \firefox.exe
    - \brave.exe
  condition: selection and not filter_browsers
falsepositives:
- Enterprise backup or profile migration scripts copying browser profiles
- Forensic or IT support tooling collecting browser profile data
level: medium
id: 3f9821c6-d90f-542f-aaf8-c2b23b9fcfcd
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/U3ByaW5nZmllbGQgUHVibGljIFNjaG9vbHNAaW50ZXJsb2Nr
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/U3ByaW5nZmllbGQgUHVibGljIFNjaG9vbHNAaW50ZXJsb2Nr

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c84d7bd5-4dea-5f34-a1ff-7b34892236b7/springfield-public-schools-ransomware-victim-disclosure.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup