Emperador ransomware group claims breach of Uniguaçu (Brazilian education sector)

Key facts for Emperador Brazilian university

Detection coverage for Emperador Brazilian university

As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2207 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Tor Multi-Hop Egress Correlated with Large Outbound Transfer to Cloud/Web Exfiltration Services — SPL

Detects the C2/exfiltration and financial-impact stage of Emperador's pattern: outbound connectivity to Tor entry/guard nodes or the group's known .onion negotiation infrastructure (multi-hop proxy, T1090.003) occurring near-in-time with an abnormally large outbound transfer to cloud-storage or anonymous file-sharing services (T1537/T1567) from a host handling financial or student-record data (T1657 financial theft), matching the double-extortion 'dual-encryption' coercion model described for this group.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1090.003, T1537, T1567, T1657
• Data sources: proxy_web_logs, zscaler_web_logs, palo_alto_traffic_logs, device_network_events
• Severity: critical
• Confidence: medium

Splunk SPL

index=proxy (sourcetype="bluecoat:proxysg" OR sourcetype="zscaler:web" OR sourcetype="palo:traffic")
| eval is_tor=if(match(dest_port, "^(9001|9030|9050|9051|9150)$") OR match(dest, "(?i)\.onion$") OR searchmatch("[|lookup tor_exit_nodes.csv ip AS dest OUTPUT is_tor_node]"), 1, 0)
| where is_tor=1
| eval hour_bucket=strftime(_time,"%Y-%m-%d %H")
| stats count as tor_conn_count by src_ip, user, hour_bucket
| join type=left src_ip, hour_bucket
    [ search index=proxy (dest_domain="*mega.nz" OR dest_domain="*transfer.sh" OR dest_domain="*anonfiles.com" OR dest_domain="*put.io" OR dest_domain="*mediafire.com" OR dest_domain="*.s3.amazonaws.com")
      | eval hour_bucket=strftime(_time,"%Y-%m-%d %H")
      | stats sum(bytes_out) as total_bytes_out values(dest_domain) as exfil_domains by src_ip, hour_bucket ]
| where total_bytes_out > 104857600
| table hour_bucket, src_ip, user, tor_conn_count, total_bytes_out, exfil_domains
| sort -total_bytes_out

Microsoft KQL

let torConn = DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort in (9001, 9030, 9050, 9051, 9150) or RemoteUrl endswith ".onion"
| summarize TorConnCount = count() by DeviceName, bin(TimeGenerated, 1h);
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteUrl has_any ("mega.nz", "transfer.sh", "anonfiles.com", "put.io", "mediafire.com", "blob.core.windows.net")
| summarize TotalBytesOut = sum(SentBytes), ExfilDomains = make_set(RemoteUrl) by DeviceName, bin(TimeGenerated, 1h)
| where TotalBytesOut > 104857600
| join kind=inner (torConn) on DeviceName, TimeGenerated
| project TimeGenerated, DeviceName, TorConnCount, TotalBytesOut, ExfilDomains
| order by TotalBytesOut desc

Sigma

title: Tor Multi-Hop Proxy Connection Correlated with Large Outbound Transfer to Cloud Exfiltration Service
id: 5c1d8a4f-7e3b-4a6c-b9d1-8f2c6a3e5b07
status: experimental
description: Detects a host establishing Tor guard/entry-node or .onion connectivity (T1090.003 Multi-hop Proxy) within the same hour as a large-volume outbound transfer to a known cloud-storage or anonymous file-sharing domain (T1537 Transfer Data to Cloud Account, T1567 Exfiltration Over Web Service) — the C2/exfiltration signature matching Emperador's Tor-hosted leak-site infrastructure and double-extortion data-theft model, with elevated financial-theft impact (T1657) when the source host handles financial or student-record data.
references:
    - https://attack.mitre.org/techniques/T1090/003/
    - https://attack.mitre.org/techniques/T1567/
    - https://www.ransomware.live/id/VW5pZ3VhY3VAZW1wZXJhZG9y
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
    - attack.command-and-control
    - attack.t1090.003
    - attack.exfiltration
    - attack.t1537
    - attack.t1567
    - attack.impact
    - attack.t1657
    - attack.tool.tor
logsource:
    category: network_connection
    product: windows
detection:
    selection_tor:
        DestinationPort:
            - 9001
            - 9030
            - 9050
            - 9051
            - 9150
    selection_onion_dns:
        QueryName|endswith: '.onion'
    selection_exfil_domain:
        DestinationHostname|contains:
            - 'mega.nz'
            - 'transfer.sh'
            - 'anonfiles.com'
            - 'put.io'
            - 'mediafire.com'
    condition: (selection_tor or selection_onion_dns) and selection_exfil_domain
falsepositives:
    - Security researchers or privacy-tooling users legitimately running Tor Browser for unrelated purposes
    - Sanctioned use of cloud-storage/file-sharing services for large legitimate file transfers (e.g., media/design departments)
level: critical

Known false positives:

• Legitimate Tor Browser use by security researchers, journalists, or privacy-conscious staff unrelated to this incident
• Sanctioned bulk transfers to approved cloud-storage tenants (e.g., corporate OneDrive/S3) that happen to exceed the byte threshold
• Backup/DR replication jobs to third-party cloud storage coinciding by chance with unrelated Tor traffic on the same subnet

Tuning notes: Feed a maintained Tor exit/guard-node IP list (e.g., via a scheduled lookup update) instead of the static port list alone to reduce false negatives from Tor's changing relay pool; scope the exfil-domain allowlist per tenant to exclude sanctioned corporate cloud-storage endpoints, and raise total_bytes_out threshold for environments with legitimately large routine transfers.

• 🔒 Anomalous Multi-Geography Sign-In Followed by Administrative Session (Emperador Initial-Access Pattern) — KQL · unlock with TL Creds
• 🔒 Mass SharePoint/OneDrive and Mailbox Export Activity Preceding Extortion Staging — KQL · unlock with TL Creds
• 🔒 Device Egress to Tor Relay Infrastructure Correlated with Large Cloud Upload — KQL · unlock with TL Creds
• 🔒 Rapid Multi-Source Successful Authentication to a Single Account (Sigma) · unlock with TL Creds
• 🔒 Archive/Export Utility Staging Large Files in Non-Standard Directories (Sigma) · unlock with TL Creds
• 🔒 Outbound Connection to Tor Relay Ports or .onion Resolution (Sigma) · unlock with TL Creds
• 🔒 Valid Accounts Abuse on Remote-Access Infrastructure (Emperador Initial-Access Pattern) — SPL · unlock with TL Creds
• 🔒 Bulk Database, Mailbox, and File-Repository Collection Preceding Extortion Staging — SPL · unlock with TL Creds

Indicators of compromise for Emperador Brazilian university

As of 2026-08-29, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2207.

Sample indicators (3 of 19)

• Domain: evn[.]com[.]vn
• URL: hxxp://emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad[.]onion/
• Domain: revealdata[.]com

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

How Emperador Brazilian university works

The group set a 13-day negotiation deadline (through 2026-09-11). The claim is unverified and consistent with Emperador's established pattern of rapid, unverified leak-site postings against a broad cross-section of sectors since first appearing on 2026-08-10.

On 2026-08-29 at 15:21 UTC, the ransomware/data-extortion group self-identified as 'Emperador' listed Uniguaçu — the trading name of Centro Universitário Vale do Iguaçu, a private higher-education institution in União da Vitória, Paraná, Brazil, credentialed by Brazil's Ministry of Education in 2019 — on its Tor-hosted data-leak site. The posting claims 'full commitment of the network having full access to infrastructure' and theft of approximately 151.0 MB of confidential and financial data, including images the actor describes as compromising to the financial sector. One evidence screenshot is referenced on the tracker listing (filename 99f3df4207ac384a1a0e9f6496264b56.png). The group set a 13-day window from the claim date (deadline approximately 2026-09-11, shown as 2026-09-13 on RansomLook's own tracking table) and threatened unspecified 'severe measures' if payment is not made. As of this writing there is no independent corroboration of the intrusion, no confirmed exploited vulnerability, and no CVE associated with the claim — this is a leak-site extortion posting, not a confirmed technical compromise.

Emperador first appeared on ransomware-tracking platforms on 2026-08-10 with a claim against the City Government of Baguio (Philippines) and has posted at a rate of roughly one new victim every 1-3 days since (12 documented leak-site posts to date per RansomLook, with the group's Tor portal maintaining ~94% average uptime over the trailing 30 days), hitting government, education, energy/utilities, manufacturing, financial-services, technology, transportation, and food-production/consumer-staples targets across the Philippines, Albania, Brazil, Vietnam, Spain, South Korea and the United States. Mallory.ai ranks Emperador #36 of 8,601 tracked threat actors by current activity. RansomLook characterizes Emperador as operating a ransomware-as-a-service (RaaS)-style leak-site platform rather than a single fixed encryptor brand, describes its core TTPs as 'infrastructure compromise' via credential theft and administrative-access capture, database/financial-record exfiltration ahead of encryption, and a 'dual-encryption' double-extortion coercion model, and notes the group's selective targeting of critical-infrastructure and government entities assessed to have high financial capacity — consistent with a victim-reconnaissance step preceding each posting. For ransom negotiation, Emperador provides victims a Tox-protocol contact and a Session-messenger identifier (observed: Session ID 054e5b6edf03e8ba012626b5dcd83a7dd47a046760bcd9b9b32d02a039d24d9608) in addition to its .onion leak-site portal.

Independent trackers and blogs (RansomLook, Mallory.ai, GalaxyWarden, HookPhish, DeXpose) uniformly note that none of the public reporting to date includes forensic indicators (malware hashes, exploited CVEs, C2 IPs, or a confirmed initial-access vector) for any Emperador claim, including this one — every reviewed victim writeup explicitly flags itself as an unverified leak-site accusation rather than a confirmed technical breach report. Notably, for the Ipro.com/RevealData claim (2026-08-27), Emperador itself stated the data had 'previously appeared under a different alias on cracked.st' and that it was re-posting the material 'just for fun,' suggesting at least some Emperador postings may recycle previously circulated or unconfirmed data rather than reflect fresh intrusions — a caution that applies generally to interpreting the group's claims, including the Uniguaçu posting reviewed here. The Uniguaçu posting itself was made without an accompanying named CVE, malware sample, or infrastructure IOC beyond the group's own leak-site address and the referenced screenshot filename, consistent with Emperador's other postings reviewed for this report.

Mallory.ai's actor profile summarizes Emperador's claimed capability set as: the group is said to "exfiltrate databases, documents, financial records, personally identifiable information, and administrative credentials; encrypt victim systems; offer stolen data for sale; and threaten publication of stolen material when victims do not engage" — while cautioning that "the underlying compromise, exfiltration, and encryption claims have not been independently verified." Individual leak-site postings reviewed for other Emperador victims (e.g., the Prefeitura Municipal de Arcos entry on RansomLook) use standardized claim language of the form "We hold complete, unrestricted access to your internal infrastructure. All servers, databases, emails, and admin credentials have been exfiltrated," indicating email-store collection and administrative-credential harvesting are part of the group's consistent (self-reported) claim template rather than incident-specific detail.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts

Command and Control

T1090.003 Multi-hop Proxy

Collection

T1114 Email Collection; T1213 Data from Information Repositories

Exfiltration

T1537 Transfer Data to Cloud Account; T1567 Exfiltration Over Web Service

Credential Access

T1552 Unsecured Credentials

Reconnaissance

T1591 Gather Victim Org Information

Impact

T1657 Financial Theft

Remediation for Emperador Brazilian university

Patches

• No CVE or specific software vulnerability has been identified in this claim; patch guidance is not applicable pending forensic confirmation of an initial-access vector

Immediate actions

• Uniguaçu IT/security teams should independently verify the claim by reviewing authentication logs, EDR/AV alerts, and backup integrity before assuming compromise
• Rotate credentials for privileged, remote-access (VPN/RDP), and financial-system accounts as a precaution given the actor's 'full infrastructure access' and stated credential-theft/administrative-access-capture TTP
• Preserve forensic evidence (logs, disk images, network captures) and engage incident response before any contact with the extortion group
• Do not access or download the referenced leak-site screenshot or any linked data from the Emperador .onion site outside a controlled, isolated investigation environment
• Treat any ransom-negotiation contact (Tox ID, Session ID, or .onion portal) as hostile infrastructure — do not engage directly; route all contact through incident response/legal counsel

Workarounds

• None applicable — this is an unverified extortion/leak-site claim, not a disclosed technical vulnerability with a documented workaround

Longer-term hardening

• Enforce MFA on all remote-access and administrative accounts, and implement least-privilege review of admin/service accounts to blunt the 'Valid Accounts' abuse pattern reported for this group
• Deploy EDR with ransomware/exfiltration-behavior detection across endpoints, file servers, and database hosts, with emphasis on bulk database export and cloud-upload detection
• Run phishing-simulation and security-awareness training for staff — social engineering/credential theft is the suspected but unconfirmed initial-access vector reported for other Emperador victims
• Monitor Emperador's leak site and known ransomware trackers (ransomware.live, RansomLook, Mallory.ai) for updates or full-data publication tied to this claim
• Review and harden externally exposed services (VPN gateways, remote-access portals, financial/student-record applications) given the group's stated 'full infrastructure access'
• Given at least one Emperador claim (Ipro.com/RevealData) reused data previously circulated under a different alias on a criminal forum, cross-check any published Uniguaçu sample against known prior leaks before assuming a novel intrusion

Affected and fixed versions

• Uniguaçu (Centro Universitário Vale do Iguaçu) — Institutional IT infrastructure, student/financial databases
  Vulnerable versions: N/A — no specific software, product, or version identified in the claim
  Fixed in: N/A

Timeline of Emperador Brazilian university

• 2026-08-10 locked-ioc-18 group first observed on ransomware trackers, claiming locked-ioc-9 (Philippines) as its first listed victim, alleging 2.9 GB of contracts, permits, and financial records
• 2026-08-16 locked-ioc-18 claims Albania's national teacher training portal, alleging ~100k national ID records and teacher certificates (5.9 GB)
• 2026-08-18 locked-ioc-18 claims locked-ioc-7 (Brazil), a government-sector victim, 462.3 MB claimed
• 2026-08-20 locked-ioc-18 claims locked-ioc-19, an education/retail-sector victim, 18.1 MB claimed
• 2026-08-22 locked-ioc-18 claims locked-ioc-6, alleging over 300 GB including 13.36 million customer rows, 6.99 million subscriptions, and 2.26 million account records
• 2026-08-23 locked-ioc-18 claims locked-ioc-15, a Spanish manufacturer, 540.1 MB claimed; full-publication deadline set for 2026-09-06
• 2026-08-27 locked-ioc-18 claims both locked-ioc-12 (120.9 MB) and Ipro.com/RevealData (79.5 MB, a 2023 database backup the group says had previously circulated under a different alias on the locked-ioc-16 forum) on the same day
• 2026-08-28 locked-ioc-18 claims locked-ioc-11, an energy-sector victim, 12 GB claimed
• 2026-08-29 locked-ioc-18 posts leak-site claim against Uniguaçu (15:21 UTC), alleging full infrastructure access and ~151.0 MB of confidential/financial data including compromising financial-sector images
• 2026-09-06 locked-ioc-18's stated full-publication deadline for the concurrent locked-ioc-15 claim, illustrating the group's typical negotiation-window length
• 2026-09-11 locked-ioc-18's stated 13-day negotiation deadline for the Uniguaçu claim (RansomLook's own tracking table lists 2026-09-13); group has threatened unspecified further action if unmet

Sources cited for Emperador Brazilian university

• emperador — Mallory.ai threat actor profile mallory.ai · Research · 2026-08-29
• Frucastro Sl Listed by Emperador Ransomware Group galaxywarden.com · Blog · 2026-08-23
• Ipro.com(revealdata.com) Listed by Emperador Ransomware Group galaxywarden.com · Blog · 2026-08-27
• Ransomware Group emperador Hits: Ipro.com(revealdata.com) customer DB + full database backup hookphish.com · Blog · 2026-08-27
• Ransomware Group emperador Hits: Albania's official national teacher training portal hookphish.com · Blog · 2026-08-16
• Emperador Ransomware Strikes Vietnam Electricity (EVNHANOI) dexpose.io · Blog · 2026-08-22
• Emperador Ransomware Attack Targets City Government of Baguio dexpose.io · Blog · 2026-08-10
• UNIGUAÇU — Centro Universitário Vale do Iguaçu institutional profile querobolsa.com.br · News · 2026-08-29
• Ransomware.live victim entry: Uniguaçu / Emperador ransomware.live · Tracker · 2026-08-29
• Emperador — RansomLook group profile ransomlook.io · Tracker · 2026-08-29

More in ransomware

• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services

More from Emperador

• Emperador Ransomware Group Claims 3.9GB Data Theft from AB InBev (Budweiser, Corona Maker) - Unverified $1M Bitcoin Extortion
• Emperador ransomware group claims A-RMS (Technology) - server encryption and source code theft

Previous and next in ransomware

• Rhysida Ransomware Claims Berlin State Government Breach Ahead of September Election Previous report
• Aurora Ransomware Actors Abuse Cursor Agent AI Coding Tool for Post-Compromise Exploitation Against ESXi and Active Directory Environments Next report