# AuditTeam ransomware claims compromise of vit.ac.in

Published: 2026-09-22 · Severity: elevated · Sectors: education
Canonical: https://vorant.io/reports/e10683ec-e7d3-5f23-953f-92b114c084da/auditteam-ransomware-claims-compromise-of-vit-ac-in

> AuditTeam ransomware operators claim to have compromised vit.ac.in with exfiltration of employee credentials and user data.

AuditTeam ransomware operators have listed vit.ac.in (Vellore Institute of Technology, India) on their leak site, claiming a compromise affecting approximately 528 compromised employees, 37,512 compromised users, and 739 third-party employee credentials. The threat actors also report identifying 200 DNS records and an external attack surface associated with the victim organization. The claim includes a leak screenshot posted on the ransomware-operator infrastructure. This appears to be a post-compromise announcement typical of double-extortion ransomware campaigns, where operators demand payment under threat of data publication. Defenders at educational institutions should treat this as confirmation of a breach affecting credential material and user data.

## Mentioned in this report

- Threat actors: AuditTeam
- Malware: AuditTeam

Source reporting: https://www.ransomware.live/id/dml0LmFjLmluQEF1ZGl0VGVhbQ==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e10683ec-e7d3-5f23-953f-92b114c084da/auditteam-ransomware-claims-compromise-of-vit-ac-in.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup