Skip to navigation

Threat reportData BreachTL-2026-2212

PEAR ransomware group claims data leak from South Plains Rural Health Services (SPRHS)

highACTIVE

The data-extortion group PEAR claims to have exfiltrated approximately 1.4 TB of data from South Plains Rural Health Services, Inc. (SPRHS), a nonprofit Federally Qualified Health Center serving rural West Texas, including personal and medical information on thousands of patients plus employee and administrative records.

Key facts for PEAR West Texas rural health

IdentifiersTL-2026-2212
SeverityHIGH
Exploitation statusNo known exploitation
Affected productsSouth Plains Rural Health Services, Inc. Patient, employee, and administrative record systems (IT environment)
AttributionPEAR (medium confidence)
MalwareDataleak, pear
ToolsAteraAgent, PSEXEC, Rclone - S1040, Splashtop, WinSCP
MITRE ATT&CK techniquesT1003 OS Credential Dumping, T1021.002 Remote Services: SMB/Windows Admin Shares, T1047 Windows Management Instrumentation, T1048 Exfiltration Over Alternative Protocol, T1059.001 Command and Scripting Interpreter: PowerShell, T1078 Valid Accounts, T1114 Email Collection, T1133 External Remote Services, T1219 Remote Access Tools, T1490 Inhibit System Recovery, T1566 Phishing, T1567.002 Exfiltration to Cloud Storage and 3 more in the attack flow
MotivationFINANCIAL
Target sectorshealth
Target regionsunited states of america, North America
Detection rules9 (1 shown free)
Sources12 cited sources

Detection coverage for PEAR West Texas rural health

As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2212 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PEAR Post-Exploitation Toolset — PsExec Lateral Movement, Credential Dumping & Log Clearing (SPL)

Detects PsExec-based lateral movement over SMB admin shares, WMI process creation, LSASS access consistent with credential dumping, Windows Security/System event-log clearing, and EDR/AV tampering commands chained together on a host -- PEAR's documented human-operated post-exploitation pattern used prior to leak-site posting.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1021.002, T1003, T1047, T1059.001, T1562.001, T1070.001
  • Data sources: sysmon, windows_security_eventlog, device_process_events, device_events, edr_telemetry
  • Severity: critical
  • Confidence: high

Splunk SPL

index=wineventlog sourcetype="WinEventLog:Security" OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=1 (Image="*\\PsExec.exe" OR Image="*\\PsExec64.exe") (CommandLine="*\\\\C$*" OR CommandLine="*ADMIN$*"))
OR (EventCode=1 Image="*\\wmic.exe" CommandLine="*process call create*")
OR (EventCode=10 TargetImage="*\\lsass.exe" GrantedAccess="0x1010")
OR (EventCode=1102) OR (EventCode=104)
OR (EventCode=1 CommandLine="*Set-MpPreference -DisableRealtimeMonitoring*" OR CommandLine="*Add-MpPreference -ExclusionPath*")
| eval technique=case(
    match(CommandLine,"(?i)C\$|ADMIN\$"), "T1021.002",
    match(Image,"(?i)wmic"), "T1047",
    match(TargetImage,"(?i)lsass"), "T1003",
    EventCode=1102 OR EventCode=104, "T1070.001",
    match(CommandLine,"(?i)DisableRealtimeMonitoring|ExclusionPath"), "T1562.001",
    1=1, "unmapped")
| stats count, values(technique) as techniques_observed, values(CommandLine) as commands by host, user, _time
| where mvcount(techniques_observed) > 0

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("PsExec.exe","PsExec64.exe") and ProcessCommandLine has_any ("\\\\C$","ADMIN$"))
   or (FileName =~ "wmic.exe" and ProcessCommandLine has "process call create")
   or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("wevtutil cl","Clear-EventLog","Set-MpPreference -DisableRealtimeMonitoring","Add-MpPreference -ExclusionPath"))
| extend Technique = case(
    ProcessCommandLine has_any ("\\\\C$","ADMIN$"), "T1021.002",
    FileName =~ "wmic.exe", "T1047",
    ProcessCommandLine has_any ("wevtutil cl","Clear-EventLog"), "T1070.001",
    ProcessCommandLine has_any ("DisableRealtimeMonitoring","ExclusionPath"), "T1562.001",
    "unmapped")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Technique
| union (
    DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType == "ProcessOpened" and FileName =~ "lsass.exe"
    | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, FileName=InitiatingProcessFileName, ProcessCommandLine=InitiatingProcessCommandLine, Technique="T1003"
)

Sigma

title: PEAR Post-Exploitation Toolset - PsExec Lateral Movement, Credential Dumping, and Log Clearing
id: 2b4d6f8a-1c3e-4a5b-8d7f-9e0a1b2c3d4e
status: experimental
description: Detects PsExec-based lateral movement over SMB admin shares, WMI process creation, LSASS access consistent with credential dumping, and Windows Security/System event-log clearing chained together -- PEAR's documented human-operated post-exploitation pattern used prior to leak-site posting.
references:
    - https://www.halcyon.ai/threat-group/pear
    - https://www.at-bay.com/threat-research/pure-extraction-ransomware-groups-prioritize-data-theft/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
    - attack.lateral-movement
    - attack.t1021.002
    - attack.credential-access
    - attack.t1003
    - attack.execution
    - attack.t1047
    - attack.t1059.001
    - attack.defense-evasion
    - attack.t1562.001
    - attack.t1070.001
    - attack.tool.psexec
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith:
            - '\PsExec.exe'
            - '\PsExec64.exe'
        CommandLine|contains:
            - '\\C$'
            - '\ADMIN$'
    selection_wmi:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'process call create'
    selection_lsass:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess: '0x1010'
    selection_logclear:
        CommandLine|contains:
            - 'wevtutil cl'
            - 'Clear-EventLog'
    selection_defenseimpair:
        CommandLine|contains:
            - 'Set-MpPreference -DisableRealtimeMonitoring'
            - 'Add-MpPreference -ExclusionPath'
    condition: 1 of selection_*
falsepositives:
    - Authorized IT administration using PsExec/WMI for legitimate remote management
    - Scheduled log rotation or SIEM forwarder maintenance
    - EDR/AV configuration changes by authorized security operations
level: critical

Known false positives:

  • Authorized IT administration using PsExec/WMI for legitimate remote server management
  • Scheduled log rotation or SIEM forwarder configuration touching event logs
  • EDR/AV exclusion changes made by authorized security operations during software rollouts
  • LSASS access by legitimate credential-management or backup agents

Tuning notes: Require correlation of >=2 distinct techniques on the same host/user within a rolling window before paging to cut single-technique admin-noise false positives; maintain an allow-list of change-managed PsExec/WMI orchestration accounts (e.g., patch-management service accounts).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • PEAR Anomalous External Remote-Access Logon & Unauthorized RMM Install (KQL) · unlock with TL Creds
  • PEAR Post-Exploitation Toolset — PsExec Lateral Movement, Credential Dumping & Log Clearing (KQL) · unlock with TL Creds
  • PEAR Bulk Exfiltration via WinSCP/RClone & Pre-Extortion Backup Deletion (KQL) · unlock with TL Creds
  • PEAR Anomalous External Remote-Access Logon & Unauthorized RMM Install (Sigma) · unlock with TL Creds
  • PEAR Post-Exploitation Toolset — PsExec Lateral Movement, Credential Dumping & Log Clearing (Sigma) · unlock with TL Creds
  • PEAR Bulk Exfiltration via WinSCP/RClone & Pre-Extortion Backup Deletion (Sigma) · unlock with TL Creds
  • PEAR Anomalous External Remote-Access Logon & Unauthorized RMM Install (SPL) · unlock with TL Creds
  • PEAR Bulk Exfiltration via WinSCP/RClone & Pre-Extortion Backup Deletion (SPL) · unlock with TL Creds

Indicators of compromise for PEAR West Texas rural health

As of 2026-08-29, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-2212.

13 indicators of compromise · unlock with TL Creds. Compare plans

How PEAR West Texas rural health works

SPRHS has not publicly confirmed or denied the claim, and no notification had appeared on the Texas Attorney General breach site as of the August 29, 2026 report.

On August 29, 2026, DataBreaches.Net (mirrored on malware.news) reported that the data-extortion group PEAR had posted South Plains Rural Health Services, Inc. (SPRHS) to its Tor leak site, claiming exfiltration of roughly 1.4 TB of data including patient personal/medical information and employee and administrative records. SPRHS is a nonprofit, Federally Qualified Health Center (FQHC) operating clinics in Levelland, Lamesa, and Big Spring, Texas, providing family medicine, dental, behavioral health, optometry, and pharmacy services to rural West Texas communities. Ransomware.live independently indexed the SPRHS listing on PEAR's leak site on July 15, 2026, and PEAR's own claim states SPRHS was notified of the intrusion on June 17, 2026 -- consistent with the group's documented multi-week dwell time between compromise and public posting.

PEAR (self-described as standing for 'Pure Extraction And Ransom') is a data-extortion operation first observed active around June-July 2025 that does not deploy encryption or custom malware. Independent trackers (Halcyon.ai, CyberXTron, At-Bay) describe a human-operated intrusion pattern built entirely on abuse of valid accounts and legitimate administrative/remote-access tooling: initial access via compromised third-party credentials, phishing, or internet-exposed RDP/VPN services lacking MFA; persistence via commodity RMM tools (AteraAgent, Splashtop) that are commonly allow-listed by security software; lateral movement and credential harvesting via PsExec-style tooling, PowerShell, and WMI; staged data collection including email/mailbox harvesting; and bulk exfiltration via WinSCP and RClone (frequently renamed to evade detection) to external infrastructure, in one documented case moving ~732 GB in 24 hours. Prior to leak-site posting, PEAR has been observed deleting backups and disabling audit/event logging to blunt recovery and forensic response. The group negotiates directly and manually -- including SMS/WhatsApp messages to employees' personal phones -- via a Tor leak site, an onionmail.org contact address, and a Tox messaging ID, applying strict payment deadlines with a rapid-payment discount of up to 10%. PEAR has scaled to 90+ claimed victims across roughly 9 countries (heavily concentrated in the US), with healthcare, legal, business-services, and financial-services organizations as recurring targets; a prior healthcare victim saw ~3.5 TB exfiltrated and 200,000 individuals affected, triggering HHS/FBI notification. No CVE exploitation or custom malware has been attributed to the group by any tracked source, and PEAR states it has 'nothing in common with any other threat actors.'

As of the August 29, 2026 report, SPRHS had made no public statement, and the group's claim remained unverified by the victim. Given the June 17, 2026 notification/discovery date PEAR states, both the Texas Attorney General's 30-day breach-reporting deadline (~July 17, 2026) and the HIPAA Breach Notification Rule's 60-day deadline for affected individuals/HHS (~August 16-17, 2026) had already lapsed with no corresponding filing found on the Texas AG breach-notification site, raising a secondary regulatory-compliance concern independent of whether PEAR's data claims are ultimately substantiated.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping

Lateral Movement

T1021.002 Remote Services: SMB/Windows Admin Shares

Execution

T1047 Windows Management Instrumentation; T1059.001 Command and Scripting Interpreter: PowerShell

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567.002 Exfiltration to Cloud Storage

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1566 Phishing

Collection

T1114 Email Collection

Command and Control

T1219 Remote Access Tools

Impact

T1490 Inhibit System Recovery; T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs

Remediation for PEAR West Texas rural health

Immediate actions

  • Engage independent forensic incident response to confirm or refute PEAR's claim and scope the alleged June 17, 2026 compromise
  • Rotate all VPN, RDP, and administrative credentials network-wide, since PEAR's documented initial-access pattern relies on reused/compromised valid accounts
  • Enforce MFA on every internet-exposed remote-access service (VPN, RDP, webmail) to close PEAR's most consistently reported entry vector
  • Hunt for AteraAgent, Splashtop, PsExec, WinSCP, and RClone execution or network artifacts, PEAR's documented toolset, across endpoints and egress logs
  • File any confirmed breach with the Texas Attorney General and begin HIPAA Breach Notification Rule assessment immediately given the lapsed statutory windows

Workarounds

  • Remove or strictly allow-list RMM tools (AteraAgent, Splashtop) so unauthorized instances cannot blend in with sanctioned IT tooling
  • Disable unused SMB admin shares and legacy remote-management protocols where not operationally required

Longer-term hardening

  • Deploy EDR with tamper protection and centralized, write-once logging to detect the audit-log clearing and AV/EDR circumvention PEAR relies on pre-extortion
  • Segment clinical systems from administrative networks and restrict SMB/Windows admin-share reachability to limit PEAR's lateral-movement path
  • Maintain offline/immutable backups resilient to pre-extortion backup deletion
  • Stand up continuous monitoring for organizational credentials appearing in third-party breach databases, PEAR's primary initial-access source

Affected and fixed versions

  • South Plains Rural Health Services, Inc. — Patient, employee, and administrative record systems (IT environment)

Timeline of PEAR West Texas rural health

  • locked-ioc-13 data-extortion group first reported active (month-level precision: June 2025); trackers describe a coordinated debut of nearly 20 victims posted to its Tor leak site in a single wave shortly after.
  • Per locked-ioc-13's own claim, SPRHS was notified of the breach on June 17, 2026 -- treated as the compromise/discovery reference date for the incident.
  • Ransomware.live indexes South Plains Rural Health Services, Inc. as a locked-ioc-13 victim at 10:59 UTC, noting a leak screenshot published on locked-ioc-13's Tor site.
  • Texas's statutory 30-day-from-discovery deadline to report a qualifying breach to the Texas Attorney General passes with no filing found on the AG breach-notification site.
  • HIPAA Breach Notification Rule's 60-day-from-discovery deadline for notifying affected individuals and HHS passes, based on the June 17, 2026 discovery date locked-ioc-13 states.
  • locked-ioc-13 lists an unrelated new victim, Club One Casino, on its leak site, evidencing continued active posting cadence around the same period as the SPRHS claim.
  • DataBreaches.Net (mirrored on malware.news) publishes the report on locked-ioc-13's claim against SPRHS; SPRHS has made no public confirmation or denial, and no Texas AG breach-site notification is found as of publication.

Sources cited for PEAR West Texas rural health

Previous and next in data breach

Drafted by the Threadlinqs research pipeline from 12 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats