# PEAR ransomware group claims data leak from South Plains Rural Health Services (SPRHS)

> The data-extortion group PEAR claims to have exfiltrated approximately 1.4 TB of data from South Plains Rural Health Services, Inc. (SPRHS), a nonprofit Federally Qualified Health Center serving rural West Texas, including personal and medical information on thousands of patients plus employee and administrative records. SPRHS has not publicly confirmed or denied the claim, and no notification had appeared on the Texas Attorney General breach site as of the August 29, 2026 report.

- **Published:** 2026-08-29T00:00:00Z
- **Last reviewed:** 2026-08-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2212
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-pear-west-texas-rural-health-tl-2026-2212.webp?v=09ffc47a (Threadlinqs threat intel: PEAR Claims South Plains Rural Health Data: Detection & IOCs (TL-2026-2212) — High severity, 13 IOCs, 9 detection rules.)
- **ID:** TL-2026-2212
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** PEAR
- **Detections:** 9 (1 shown free below) · **IOCs:** 13

## Description

On August 29, 2026, DataBreaches.Net (mirrored on malware.news) reported that the data-extortion group PEAR had posted South Plains Rural Health Services, Inc. (SPRHS) to its Tor leak site, claiming exfiltration of roughly 1.4 TB of data including patient personal/medical information and employee and administrative records. SPRHS is a nonprofit, Federally Qualified Health Center (FQHC) operating clinics in Levelland, Lamesa, and Big Spring, Texas, providing family medicine, dental, behavioral health, optometry, and pharmacy services to rural West Texas communities. Ransomware.live independently indexed the SPRHS listing on PEAR's leak site on July 15, 2026, and PEAR's own claim states SPRHS was notified of the intrusion on June 17, 2026 -- consistent with the group's documented multi-week dwell time between compromise and public posting.

PEAR (self-described as standing for 'Pure Extraction And Ransom') is a data-extortion operation first observed active around June-July 2025 that does not deploy encryption or custom malware. Independent trackers (Halcyon.ai, CyberXTron, At-Bay) describe a human-operated intrusion pattern built entirely on abuse of valid accounts and legitimate administrative/remote-access tooling: initial access via compromised third-party credentials, phishing, or internet-exposed RDP/VPN services lacking MFA; persistence via commodity RMM tools (AteraAgent, Splashtop) that are commonly allow-listed by security software; lateral movement and credential harvesting via PsExec-style tooling, PowerShell, and WMI; staged data collection including email/mailbox harvesting; and bulk exfiltration via WinSCP and RClone (frequently renamed to evade detection) to external infrastructure, in one documented case moving ~732 GB in 24 hours. Prior to leak-site posting, PEAR has been observed deleting backups and disabling audit/event logging to blunt recovery and forensic response. The group negotiates directly and manually -- including SMS/WhatsApp messages to employees' personal phones -- via a Tor leak site, an onionmail.org contact address, and a Tox messaging ID, applying strict payment deadlines with a rapid-payment discount of up to 10%. PEAR has scaled to 90+ claimed victims across roughly 9 countries (heavily concentrated in the US), with healthcare, legal, business-services, and financial-services organizations as recurring targets; a prior healthcare victim saw ~3.5 TB exfiltrated and 200,000 individuals affected, triggering HHS/FBI notification. No CVE exploitation or custom malware has been attributed to the group by any tracked source, and PEAR states it has 'nothing in common with any other threat actors.'

As of the August 29, 2026 report, SPRHS had made no public statement, and the group's claim remained unverified by the victim. Given the June 17, 2026 notification/discovery date PEAR states, both the Texas Attorney General's 30-day breach-reporting deadline (~July 17, 2026) and the HIPAA Breach Notification Rule's 60-day deadline for affected individuals/HHS (~August 16-17, 2026) had already lapsed with no corresponding filing found on the Texas AG breach-notification site, raising a secondary regulatory-compliance concern independent of whether PEAR's data claims are ultimately substantiated.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1566 Phishing
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1047 Windows Management Instrumentation
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1003 OS Credential Dumping
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1114 Email Collection
- T1567.002 Exfiltration to Cloud Storage
- T1048 Exfiltration Over Alternative Protocol
- T1219 Remote Access Tools
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PEAR Post-Exploitation Toolset — PsExec Lateral Movement, Credential Dumping & Log Clearing (SPL)** (`TL-2026-2212-SPL-002`)

Detects PsExec-based lateral movement over SMB admin shares, WMI process creation, LSASS access consistent with credential dumping, Windows Security/System event-log clearing, and EDR/AV tampering commands chained together on a host -- PEAR's documented human-operated post-exploitation pattern used prior to leak-site posting.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1021.002, T1003, T1047, T1059.001, T1562.001, T1070.001
- **Data sources:** sysmon, windows_security_eventlog, device_process_events, device_events, edr_telemetry
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=wineventlog sourcetype="WinEventLog:Security" OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=1 (Image="*\\PsExec.exe" OR Image="*\\PsExec64.exe") (CommandLine="*\\\\C$*" OR CommandLine="*ADMIN$*"))
OR (EventCode=1 Image="*\\wmic.exe" CommandLine="*process call create*")
OR (EventCode=10 TargetImage="*\\lsass.exe" GrantedAccess="0x1010")
OR (EventCode=1102) OR (EventCode=104)
OR (EventCode=1 CommandLine="*Set-MpPreference -DisableRealtimeMonitoring*" OR CommandLine="*Add-MpPreference -ExclusionPath*")
| eval technique=case(
    match(CommandLine,"(?i)C\$|ADMIN\$"), "T1021.002",
    match(Image,"(?i)wmic"), "T1047",
    match(TargetImage,"(?i)lsass"), "T1003",
    EventCode=1102 OR EventCode=104, "T1070.001",
    match(CommandLine,"(?i)DisableRealtimeMonitoring|ExclusionPath"), "T1562.001",
    1=1, "unmapped")
| stats count, values(technique) as techniques_observed, values(CommandLine) as commands by host, user, _time
| where mvcount(techniques_observed) > 0
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("PsExec.exe","PsExec64.exe") and ProcessCommandLine has_any ("\\\\C$","ADMIN$"))
   or (FileName =~ "wmic.exe" and ProcessCommandLine has "process call create")
   or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("wevtutil cl","Clear-EventLog","Set-MpPreference -DisableRealtimeMonitoring","Add-MpPreference -ExclusionPath"))
| extend Technique = case(
    ProcessCommandLine has_any ("\\\\C$","ADMIN$"), "T1021.002",
    FileName =~ "wmic.exe", "T1047",
    ProcessCommandLine has_any ("wevtutil cl","Clear-EventLog"), "T1070.001",
    ProcessCommandLine has_any ("DisableRealtimeMonitoring","ExclusionPath"), "T1562.001",
    "unmapped")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Technique
| union (
    DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType == "ProcessOpened" and FileName =~ "lsass.exe"
    | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, FileName=InitiatingProcessFileName, ProcessCommandLine=InitiatingProcessCommandLine, Technique="T1003"
)
```

### Sigma

```yaml
title: PEAR Post-Exploitation Toolset - PsExec Lateral Movement, Credential Dumping, and Log Clearing
id: 2b4d6f8a-1c3e-4a5b-8d7f-9e0a1b2c3d4e
status: experimental
description: Detects PsExec-based lateral movement over SMB admin shares, WMI process creation, LSASS access consistent with credential dumping, and Windows Security/System event-log clearing chained together -- PEAR's documented human-operated post-exploitation pattern used prior to leak-site posting.
references:
    - https://www.halcyon.ai/threat-group/pear
    - https://www.at-bay.com/threat-research/pure-extraction-ransomware-groups-prioritize-data-theft/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
    - attack.lateral-movement
    - attack.t1021.002
    - attack.credential-access
    - attack.t1003
    - attack.execution
    - attack.t1047
    - attack.t1059.001
    - attack.defense-evasion
    - attack.t1562.001
    - attack.t1070.001
    - attack.tool.psexec
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith:
            - '\PsExec.exe'
            - '\PsExec64.exe'
        CommandLine|contains:
            - '\\C$'
            - '\ADMIN$'
    selection_wmi:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'process call create'
    selection_lsass:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess: '0x1010'
    selection_logclear:
        CommandLine|contains:
            - 'wevtutil cl'
            - 'Clear-EventLog'
    selection_defenseimpair:
        CommandLine|contains:
            - 'Set-MpPreference -DisableRealtimeMonitoring'
            - 'Add-MpPreference -ExclusionPath'
    condition: 1 of selection_*
falsepositives:
    - Authorized IT administration using PsExec/WMI for legitimate remote management
    - Scheduled log rotation or SIEM forwarder maintenance
    - EDR/AV configuration changes by authorized security operations
level: critical
```

**Known false positives:**

- Authorized IT administration using PsExec/WMI for legitimate remote server management
- Scheduled log rotation or SIEM forwarder configuration touching event logs
- EDR/AV exclusion changes made by authorized security operations during software rollouts
- LSASS access by legitimate credential-management or backup agents

**Tuning notes:** Require correlation of >=2 distinct techniques on the same host/user within a rolling window before paging to cut single-technique admin-noise false positives; maintain an allow-list of change-managed PsExec/WMI orchestration accounts (e.g., patch-management service accounts).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PEAR Anomalous External Remote-Access Logon & Unauthorized RMM Install (KQL) (locked: unlock with TL Creds)
- PEAR Post-Exploitation Toolset — PsExec Lateral Movement, Credential Dumping & Log Clearing (KQL) (locked: unlock with TL Creds)
- PEAR Bulk Exfiltration via WinSCP/RClone & Pre-Extortion Backup Deletion (KQL) (locked: unlock with TL Creds)
- PEAR Anomalous External Remote-Access Logon & Unauthorized RMM Install (Sigma) (locked: unlock with TL Creds)
- PEAR Post-Exploitation Toolset — PsExec Lateral Movement, Credential Dumping & Log Clearing (Sigma) (locked: unlock with TL Creds)
- PEAR Bulk Exfiltration via WinSCP/RClone & Pre-Extortion Backup Deletion (Sigma) (locked: unlock with TL Creds)
- PEAR Anomalous External Remote-Access Logon & Unauthorized RMM Install (SPL) (locked: unlock with TL Creds)
- PEAR Bulk Exfiltration via WinSCP/RClone & Pre-Extortion Backup Deletion (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [PEAR leaks data allegedly exfiltrated from South Plains Rural Health Services while SPRHS remains silent](https://databreaches.net/2026/08/29/pear-leaks-data-allegedly-exfiltrated-from-south-plains-rural-health-services-while-sprhs-remains-silent/)
- [PEAR leaks data allegedly exfiltrated from South Plains Rural Health Services while SPRHS remains silent (mirror)](https://malware.news/t/pear-leaks-data-allegedly-exfiltrated-from-south-plains-rural-health-services-while-sprhs-remains-silent/125191)
- [PEAR - Threat Group Profile](https://www.halcyon.ai/threat-group/pear)
- [PEAR Threat Profile: Redefining Ransomware Through Data Exposure](https://cyberxtron.com/resources/blogs/pear-threat-profile-redefining-ransomware-through-data-exposure-7862)
- [Pure Extraction: Ransomware Groups Prioritize Data Theft](https://www.at-bay.com/threat-research/pure-extraction-ransomware-groups-prioritize-data-theft/)
- [Ransomware.live - Victim: South Plains Rural Health Services, Inc. (PEAR)](https://www.ransomware.live/id/U291dGggUGxhaW5zIFJ1cmFsIEhlYWx0aCBTZXJ2aWNlcywgSW5jLkBwZWFy)
- [Club One Casino Listed by Pear Ransomware Group](https://www.galaxywarden.com/blog/breach/club-one-casino-pear-2026-08)
- [Pear Ransomware Group Compromises Family Psychological Associates](https://www.dexpose.io/pear-ransomware-group-compromises-family-psychological-associates/)
- [Data Breach Reporting - Office of the Attorney General of Texas](https://www.texasattorneygeneral.gov/consumer-protection/data-breach-reporting)
- [Texas | Summary of U.S. State Data Breach Notification Statutes](https://www.dwt.com/gcp/states/texas)
- [South Plains Rural Health Services Inc - Nonprofit Explorer](https://projects.propublica.org/nonprofits/organizations/752123252)
- [About - South Plains Rural Health](https://sprhs.org/about/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2212