# Emperador ransomware group claims breach of Uniguaçu (Brazilian education sector)

> The newly observed extortion group 'Emperador' posted a leak-site claim against Uniguaçu (Centro Universitário Vale do Iguaçu), a Brazilian higher-education institution, alleging full network access and theft of ~151.0 MB of confidential and financial data, including images the actor describes as compromising to the financial sector. The group set a 13-day negotiation deadline (through 2026-09-11). The claim is unverified and consistent with Emperador's established pattern of rapid, unverified leak-site postings against a broad cross-section of sectors since first appearing on 2026-08-10.

- **Published:** 2026-08-29T15:21:00Z
- **Last reviewed:** 2026-08-29T15:21:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2207
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-emperador-brazilian-university-tl-2026-2207.webp?v=79755b66 (Threadlinqs threat intel: Emperador Claims Uniguaçu Educational Data: Detection & IOCs (TL-2026-2207) — Medium severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-2207
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Emperador
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

On 2026-08-29 at 15:21 UTC, the ransomware/data-extortion group self-identified as 'Emperador' listed Uniguaçu — the trading name of Centro Universitário Vale do Iguaçu, a private higher-education institution in União da Vitória, Paraná, Brazil, credentialed by Brazil's Ministry of Education in 2019 — on its Tor-hosted data-leak site. The posting claims 'full commitment of the network having full access to infrastructure' and theft of approximately 151.0 MB of confidential and financial data, including images the actor describes as compromising to the financial sector. One evidence screenshot is referenced on the tracker listing (filename 99f3df4207ac384a1a0e9f6496264b56.png). The group set a 13-day window from the claim date (deadline approximately 2026-09-11, shown as 2026-09-13 on RansomLook's own tracking table) and threatened unspecified 'severe measures' if payment is not made. As of this writing there is no independent corroboration of the intrusion, no confirmed exploited vulnerability, and no CVE associated with the claim — this is a leak-site extortion posting, not a confirmed technical compromise.

Emperador first appeared on ransomware-tracking platforms on 2026-08-10 with a claim against the City Government of Baguio (Philippines) and has posted at a rate of roughly one new victim every 1-3 days since (12 documented leak-site posts to date per RansomLook, with the group's Tor portal maintaining ~94% average uptime over the trailing 30 days), hitting government, education, energy/utilities, manufacturing, financial-services, technology, transportation, and food-production/consumer-staples targets across the Philippines, Albania, Brazil, Vietnam, Spain, South Korea and the United States. Mallory.ai ranks Emperador #36 of 8,601 tracked threat actors by current activity. RansomLook characterizes Emperador as operating a ransomware-as-a-service (RaaS)-style leak-site platform rather than a single fixed encryptor brand, describes its core TTPs as 'infrastructure compromise' via credential theft and administrative-access capture, database/financial-record exfiltration ahead of encryption, and a 'dual-encryption' double-extortion coercion model, and notes the group's selective targeting of critical-infrastructure and government entities assessed to have high financial capacity — consistent with a victim-reconnaissance step preceding each posting. For ransom negotiation, Emperador provides victims a Tox-protocol contact and a Session-messenger identifier (observed: Session ID 054e5b6edf03e8ba012626b5dcd83a7dd47a046760bcd9b9b32d02a039d24d9608) in addition to its .onion leak-site portal.

Independent trackers and blogs (RansomLook, Mallory.ai, GalaxyWarden, HookPhish, DeXpose) uniformly note that none of the public reporting to date includes forensic indicators (malware hashes, exploited CVEs, C2 IPs, or a confirmed initial-access vector) for any Emperador claim, including this one — every reviewed victim writeup explicitly flags itself as an unverified leak-site accusation rather than a confirmed technical breach report. Notably, for the Ipro.com/RevealData claim (2026-08-27), Emperador itself stated the data had 'previously appeared under a different alias on cracked.st' and that it was re-posting the material 'just for fun,' suggesting at least some Emperador postings may recycle previously circulated or unconfirmed data rather than reflect fresh intrusions — a caution that applies generally to interpreting the group's claims, including the Uniguaçu posting reviewed here. The Uniguaçu posting itself was made without an accompanying named CVE, malware sample, or infrastructure IOC beyond the group's own leak-site address and the referenced screenshot filename, consistent with Emperador's other postings reviewed for this report.

Mallory.ai's actor profile summarizes Emperador's claimed capability set as: the group is said to "exfiltrate databases, documents, financial records, personally identifiable information, and administrative credentials; encrypt victim systems; offer stolen data for sale; and threaten publication of stolen material when victims do not engage" — while cautioning that "the underlying compromise, exfiltration, and encryption claims have not been independently verified." Individual leak-site postings reviewed for other Emperador victims (e.g., the Prefeitura Municipal de Arcos entry on RansomLook) use standardized claim language of the form "We hold complete, unrestricted access to your internal infrastructure. All servers, databases, emails, and admin credentials have been exfiltrated," indicating email-store collection and administrative-credential harvesting are part of the group's consistent (self-reported) claim template rather than incident-specific detail.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1078 Valid Accounts
- T1552 Unsecured Credentials
- T1213 Data from Information Repositories
- T1114 Email Collection
- T1537 Transfer Data to Cloud Account
- T1567 Exfiltration Over Web Service
- T1090.003 Multi-hop Proxy
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Tor Multi-Hop Egress Correlated with Large Outbound Transfer to Cloud/Web Exfiltration Services — SPL** (`TL-2026-2207-SPL-003`)

Detects the C2/exfiltration and financial-impact stage of Emperador's pattern: outbound connectivity to Tor entry/guard nodes or the group's known .onion negotiation infrastructure (multi-hop proxy, T1090.003) occurring near-in-time with an abnormally large outbound transfer to cloud-storage or anonymous file-sharing services (T1537/T1567) from a host handling financial or student-record data (T1657 financial theft), matching the double-extortion 'dual-encryption' coercion model described for this group.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1090.003, T1537, T1567, T1657
- **Data sources:** proxy_web_logs, zscaler_web_logs, palo_alto_traffic_logs, device_network_events
- **Severity:** critical
- **Confidence:** medium

### Splunk SPL

```spl
index=proxy (sourcetype="bluecoat:proxysg" OR sourcetype="zscaler:web" OR sourcetype="palo:traffic")
| eval is_tor=if(match(dest_port, "^(9001|9030|9050|9051|9150)$") OR match(dest, "(?i)\.onion$") OR searchmatch("[|lookup tor_exit_nodes.csv ip AS dest OUTPUT is_tor_node]"), 1, 0)
| where is_tor=1
| eval hour_bucket=strftime(_time,"%Y-%m-%d %H")
| stats count as tor_conn_count by src_ip, user, hour_bucket
| join type=left src_ip, hour_bucket
    [ search index=proxy (dest_domain="*mega.nz" OR dest_domain="*transfer.sh" OR dest_domain="*anonfiles.com" OR dest_domain="*put.io" OR dest_domain="*mediafire.com" OR dest_domain="*.s3.amazonaws.com")
      | eval hour_bucket=strftime(_time,"%Y-%m-%d %H")
      | stats sum(bytes_out) as total_bytes_out values(dest_domain) as exfil_domains by src_ip, hour_bucket ]
| where total_bytes_out > 104857600
| table hour_bucket, src_ip, user, tor_conn_count, total_bytes_out, exfil_domains
| sort -total_bytes_out
```

### Microsoft KQL

```kql
let torConn = DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort in (9001, 9030, 9050, 9051, 9150) or RemoteUrl endswith ".onion"
| summarize TorConnCount = count() by DeviceName, bin(TimeGenerated, 1h);
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteUrl has_any ("mega.nz", "transfer.sh", "anonfiles.com", "put.io", "mediafire.com", "blob.core.windows.net")
| summarize TotalBytesOut = sum(SentBytes), ExfilDomains = make_set(RemoteUrl) by DeviceName, bin(TimeGenerated, 1h)
| where TotalBytesOut > 104857600
| join kind=inner (torConn) on DeviceName, TimeGenerated
| project TimeGenerated, DeviceName, TorConnCount, TotalBytesOut, ExfilDomains
| order by TotalBytesOut desc
```

### Sigma

```yaml
title: Tor Multi-Hop Proxy Connection Correlated with Large Outbound Transfer to Cloud Exfiltration Service
id: 5c1d8a4f-7e3b-4a6c-b9d1-8f2c6a3e5b07
status: experimental
description: Detects a host establishing Tor guard/entry-node or .onion connectivity (T1090.003 Multi-hop Proxy) within the same hour as a large-volume outbound transfer to a known cloud-storage or anonymous file-sharing domain (T1537 Transfer Data to Cloud Account, T1567 Exfiltration Over Web Service) — the C2/exfiltration signature matching Emperador's Tor-hosted leak-site infrastructure and double-extortion data-theft model, with elevated financial-theft impact (T1657) when the source host handles financial or student-record data.
references:
    - https://attack.mitre.org/techniques/T1090/003/
    - https://attack.mitre.org/techniques/T1567/
    - https://www.ransomware.live/id/VW5pZ3VhY3VAZW1wZXJhZG9y
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
    - attack.command-and-control
    - attack.t1090.003
    - attack.exfiltration
    - attack.t1537
    - attack.t1567
    - attack.impact
    - attack.t1657
    - attack.tool.tor
logsource:
    category: network_connection
    product: windows
detection:
    selection_tor:
        DestinationPort:
            - 9001
            - 9030
            - 9050
            - 9051
            - 9150
    selection_onion_dns:
        QueryName|endswith: '.onion'
    selection_exfil_domain:
        DestinationHostname|contains:
            - 'mega.nz'
            - 'transfer.sh'
            - 'anonfiles.com'
            - 'put.io'
            - 'mediafire.com'
    condition: (selection_tor or selection_onion_dns) and selection_exfil_domain
falsepositives:
    - Security researchers or privacy-tooling users legitimately running Tor Browser for unrelated purposes
    - Sanctioned use of cloud-storage/file-sharing services for large legitimate file transfers (e.g., media/design departments)
level: critical
```

**Known false positives:**

- Legitimate Tor Browser use by security researchers, journalists, or privacy-conscious staff unrelated to this incident
- Sanctioned bulk transfers to approved cloud-storage tenants (e.g., corporate OneDrive/S3) that happen to exceed the byte threshold
- Backup/DR replication jobs to third-party cloud storage coinciding by chance with unrelated Tor traffic on the same subnet

**Tuning notes:** Feed a maintained Tor exit/guard-node IP list (e.g., via a scheduled lookup update) instead of the static port list alone to reduce false negatives from Tor's changing relay pool; scope the exfil-domain allowlist per tenant to exclude sanctioned corporate cloud-storage endpoints, and raise total_bytes_out threshold for environments with legitimately large routine transfers.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Anomalous Multi-Geography Sign-In Followed by Administrative Session (Emperador Initial-Access Pattern) — KQL (locked: unlock with TL Creds)
- Mass SharePoint/OneDrive and Mailbox Export Activity Preceding Extortion Staging — KQL (locked: unlock with TL Creds)
- Device Egress to Tor Relay Infrastructure Correlated with Large Cloud Upload — KQL (locked: unlock with TL Creds)
- Rapid Multi-Source Successful Authentication to a Single Account (Sigma) (locked: unlock with TL Creds)
- Archive/Export Utility Staging Large Files in Non-Standard Directories (Sigma) (locked: unlock with TL Creds)
- Outbound Connection to Tor Relay Ports or .onion Resolution (Sigma) (locked: unlock with TL Creds)
- Valid Accounts Abuse on Remote-Access Infrastructure (Emperador Initial-Access Pattern) — SPL (locked: unlock with TL Creds)
- Bulk Database, Mailbox, and File-Repository Collection Preceding Extortion Staging — SPL (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- Domain: `evn[.]com[.]vn`
- URL: `hxxp://emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad[.]onion/`
- Domain: `revealdata[.]com`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Ransomware.live victim entry: Uniguaçu / Emperador](https://www.ransomware.live/id/VW5pZ3VhY3VAZW1wZXJhZG9y)
- [Emperador — RansomLook group profile](https://www.ransomlook.io/group/emperador)
- [emperador — Mallory.ai threat actor profile](https://mallory.ai/actors/019ff696-8b71-76be-ae3b-5a37071ca975)
- [Frucastro Sl Listed by Emperador Ransomware Group](https://www.galaxywarden.com/blog/breach/frucastro-sl-emperador-2026-08)
- [Ipro.com(revealdata.com) Listed by Emperador Ransomware Group](https://www.galaxywarden.com/blog/breach/ipro-com-revealdata-com-emperador-2026-08)
- [Ransomware Group emperador Hits: Ipro.com(revealdata.com) customer DB + full database backup](https://www.hookphish.com/blog/ransomware-group-emperador-hits-ipro-comrevealdata-com-customer-db-full-database-backup/)
- [Ransomware Group emperador Hits: Albania's official national teacher training portal](https://www.hookphish.com/blog/ransomware-group-emperador-hits-albanias-official-national-teacher-training-portal/)
- [Emperador Ransomware Strikes Vietnam Electricity (EVNHANOI)](https://www.dexpose.io/emperador-ransomware-strikes-vietnam-electricity-evnhanoi/)
- [Emperador Ransomware Attack Targets City Government of Baguio](https://www.dexpose.io/emperador-ransomware-attack-targets-city-government-of-baguio/)
- [UNIGUAÇU — Centro Universitário Vale do Iguaçu institutional profile](https://querobolsa.com.br/uniguacu)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2207