Ransomware Attack Disrupts IT Systems and Services in Ellis County, Kansas

Key facts for Ellis County, Kansas ransomware

Detection coverage for Ellis County, Kansas ransomware

As of 2026-09-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2571 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PsExec-Style Remote Service Lateral Movement, HTTP(S) Beaconing & Shadow-Copy Destruction — C2/Lateral Movement Phase

Detects the final pre-impact chain documented in SLTT ransomware intrusions per CISA #StopRansomware Guide: remote-service installation via ADMIN$ (PsExec-style lateral movement), sustained periodic outbound HTTP/HTTPS connections consistent with C2 beaconing, and destruction of Volume Shadow Copies / backup catalogs (Inhibit System Recovery) immediately preceding mass file encryption (Data Encrypted for Impact). Ellis County's ransomware attack fits this documented pattern; this specific chain is not forensically confirmed for the intrusion but is provided as a sourced detection baseline for the deployment/impact stage.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1021, T1071, T1490, T1486
• Data sources: sysmon, windows_security, edr_network_events
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon (EventCode=1 OR EventCode=3 OR EventCode=7045)
| eval detection_leg=case(
    EventCode=7045 AND like(ServiceFileName, "%ADMIN$%"), "remote_service_lateral",
    EventCode=1 AND (CommandLine="*vssadmin delete shadows*" OR CommandLine="*wbadmin delete catalog*" OR CommandLine="*bcdedit*recoveryenabled*no*" OR CommandLine="*wmic shadowcopy delete*"), "inhibit_recovery",
    EventCode=3 AND dest_port IN (443,80) AND NOT [| inputlookup known_good_cdn_ranges.csv | fields dest_ip], "c2_beacon_candidate")
| where isnotnull(detection_leg)
| append
    [ search index=sysmon EventCode=11 (TargetFilename="*.locked" OR TargetFilename="*.encrypted" OR TargetFilename="*README*ransom*")
    | eval detection_leg="mass_encryption_indicator" ]
| stats count, values(detection_leg) as legs, values(CommandLine) as commands, values(ServiceFileName) as services by host, user
| table host, user, legs, commands, services, count
| sort -count

Microsoft KQL

let remoteServiceLateral =
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "ServiceInstalled"
| where AdditionalFields has "ADMIN$" or InitiatingProcessFileName =~ "psexesvc.exe" or FileName =~ "psexesvc.exe"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Detail = FileName, DetectionLeg = "remote_service_lateral";
let inhibitRecovery =
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("vssadmin delete shadows","wbadmin delete catalog","bcdedit /set {default} recoveryenabled no","wmic shadowcopy delete")
| project Timestamp, DeviceName, AccountName, Detail = ProcessCommandLine, DetectionLeg = "inhibit_recovery";
let c2Beacon =
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (443, 80)
| summarize BeaconCount = count() by DeviceName, RemoteIP, bin(Timestamp, 1h)
| where BeaconCount >= 20
| project Timestamp = now(), DeviceName, AccountName = "n/a", Detail = strcat("RemoteIP=", RemoteIP, " count=", BeaconCount), DetectionLeg = "c2_beacon_candidate";
remoteServiceLateral
| union inhibitRecovery, c2Beacon
| order by Timestamp desc

Sigma

title: Shadow Copy and Backup Catalog Deletion Prior to Suspected Ransomware Encryption
id: 9a3f6c2e-7d1b-4e5a-b8c4-3f0d6e9a1b7c
status: experimental
description: Detects use of vssadmin, wbadmin, wmic shadowcopy, or bcdedit to delete Volume Shadow Copies, delete the Windows Backup catalog, or disable recovery -- the Inhibit System Recovery step ransomware operators perform immediately before mass file encryption, following remote-service lateral movement (e.g. PsExec) and C2 beaconing in SLTT government intrusions per CISA #StopRansomware Guide.
references:
    - https://www.cisa.gov/stopransomware/ransomware-guide
    - https://attack.mitre.org/techniques/T1490/
    - https://attack.mitre.org/techniques/T1486/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/09/18
tags:
    - attack.impact
    - attack.t1490
    - attack.t1486
    - attack.lateral-movement
    - attack.t1021
    - attack.command-and-control
    - attack.t1071
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    selection_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains: 'delete catalog'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains|all:
            - 'recoveryenabled'
            - 'no'
    condition: 1 of selection_*
falsepositives:
    - Authorized backup-retention cleanup or disk-space-management scripts run by IT/backup administrators
    - Sysprep/imaging workflows that legitimately disable recovery options during deployment
level: critical

Known false positives:

• Authorized IT deployment tools (SCCM, PDQ Deploy) that install services via ADMIN$ for legitimate software push
• Scheduled backup-retention cleanup or disk-space-management scripts run by backup administrators
• CDN-fronted SaaS traffic on 443/80 with regular polling intervals unrelated to C2

Tuning notes: Populate known_good_cdn_ranges.csv with the county's sanctioned SaaS/CDN egress ranges to cut c2_beacon_candidate false positives; alert immediately (do not batch) on any inhibit_recovery match given its near-zero legitimate rate outside scheduled backup maintenance windows.

• 🔒 Phishing-Triggered Office-to-Interpreter Spawn & External Remote Access Anomaly — Exploitation Phase · unlock with TL Creds
• 🔒 LSASS Credential Dumping with Discovery Recon and Valid-Account Spread — Post-Exploitation Phase · unlock with TL Creds
• 🔒 PsExec-Style Remote Service Lateral Movement, HTTP(S) Beaconing & Shadow-Copy Destruction — C2/Lateral Movement Phase · unlock with TL Creds
• 🔒 Phishing-Triggered Office-to-Interpreter Spawn & External Remote Access Anomaly — Exploitation Phase · unlock with TL Creds
• 🔒 LSASS Credential Dumping with Discovery Recon and Valid-Account Spread — Post-Exploitation Phase · unlock with TL Creds
• 🔒 PsExec-Style Remote Service Lateral Movement, HTTP(S) Beaconing & Shadow-Copy Destruction — C2/Lateral Movement Phase · unlock with TL Creds
• 🔒 Phishing-Triggered Office-to-Interpreter Spawn & External Remote Access Anomaly — Exploitation Phase · unlock with TL Creds
• 🔒 LSASS Credential Dumping with Discovery Recon and Valid-Account Spread — Post-Exploitation Phase · unlock with TL Creds

Indicators of compromise for Ellis County, Kansas ransomware

As of 2026-09-18, Threadlinqs Intelligence tracks 4 indicators of compromise for TL-2026-2571.

How Ellis County, Kansas ransomware works

On the morning of Thursday, September 17, 2026, Ellis County, Kansas (seat: Hays) discovered a ransomware attack affecting portions of its county government information technology systems. Officials stated they immediately took steps to contain the disruption by isolating the affected systems and engaging outside cybersecurity specialists to investigate and assist recovery. Local law enforcement, the Kansas Highway Patrol, and the Kansas Bureau of Investigation (KBI) were brought in to support the response. The county publicly disclosed the incident on Friday, September 18, 2026, warning residents that some county services may be unavailable, delayed, or operating under temporary procedures for days or weeks, while confirming that 911 and emergency public-safety response were not affected. Officials stated that, as of disclosure, there was no evidence that personal or sensitive information had been accessed or obtained, though the investigation was ongoing; residents were advised to exercise caution with any emails purporting to come from the county's official ellisco.net domain and to contact individual departments directly for service-availability updates.

As of this writing, no ransomware group has publicly claimed responsibility (no leak-site posting identified), no CVE or specific initial-access vector has been disclosed, and no technical indicators of compromise (malware family, hashes, C2 infrastructure) have been made public. The incident is consistent with a broader, well-documented wave of ransomware intrusions against U.S. state, local, tribal, and territorial (SLTT) government entities through 2025-2026, which CISA and the Multi-State Information Sharing and Analysis Center (MS-ISAC) attribute predominantly to phishing, exposed/unpatched remote-access services (RDP/VPN), and stolen or brokered credentials as initial-access vectors, followed by living-off-the-land lateral movement, credential dumping, and data encryption for impact. The MITRE ATT&CK techniques mapped below reflect this documented SLTT ransomware pattern per CISA/MS-ISAC #StopRansomware guidance and are NOT forensic findings confirmed specific to the Ellis County intrusion; they are included to give defenders a sourced, evidence-grounded starting hunt/detection baseline pending further disclosure. Exfiltration- and collection-tactic techniques are deliberately excluded because officials explicitly stated no evidence of data access has been found.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping

Lateral Movement

T1021 Remote Services

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol

Persistence

T1078 Valid Accounts

Discovery

T1082 System Information Discovery

Initial Access

T1133 External Remote Services; T1566 Phishing

Impact

T1490 Inhibit System Recovery

Remediation for Ellis County, Kansas ransomware

Patches

• No vendor patch identified; root cause and initial-access vector not yet publicly disclosed

Immediate actions

• Maintain isolation of affected systems from the county network until confirmed clean by incident responders
• Preserve forensic evidence (disk images, logs, memory captures) before rebuilding or restoring any system
• Force password resets and enforce MFA on all county accounts, prioritizing privileged, remote-access, and email accounts
• Do not pay any ransom demand without first consulting law enforcement (KBI/FBI) and legal counsel
• Notify residents and affected departments promptly if evidence of accessed personal data later emerges

Workarounds

• Continue manual/offline processes for affected county services until systems are restored
• Direct residents to contact individual county departments for current service-availability status

Longer-term hardening

• Deploy EDR with behavioral detection across county endpoints and servers
• Segment administrative, public-safety, and general government IT networks from one another
• Adopt offline, immutable backups and test restoration procedures on a regular cadence
• Reduce internet-exposed remote access services (RDP/VPN) and require phishing-resistant MFA where they must remain exposed
• Enroll in and actively use MS-ISAC threat-sharing and incident-response resources for SLTT government entities

Affected and fixed versions

• Ellis County, Kansas (county government) — County government IT systems and network infrastructure
  Vulnerable versions: not publicly specified as of disclosure

Timeline of Ellis County, Kansas ransomware

• 2026-09-17 Local law enforcement, the locked-ioc-3, and the locked-ioc-2 were brought in to assist with the investigation.
• 2026-09-17 Ellis County engaged outside cybersecurity specialists to investigate the incident and assist with recovery.
• 2026-09-17 County officials immediately isolated the affected systems to contain the disruption and prevent further spread.
• 2026-09-17 Ellis County IT staff discovered a ransomware attack affecting parts of the county's information technology systems in the early morning hours.
• 2026-09-18 Ellis County advised residents to contact individual departments for service-availability updates and to exercise caution with emails purporting to come from the locked-ioc-4 domain.
• 2026-09-18 Officials confirmed that 911 and emergency public-safety response were not affected by the incident.
• 2026-09-18 County officials stated there was, at that time, no evidence that personal or sensitive information had been accessed or obtained, with the investigation ongoing.
• 2026-09-18 Ellis County publicly disclosed the ransomware attack; DataBreaches.net, KSN, Hays Post, and Malware News reported the disclosure.

Sources cited for Ellis County, Kansas ransomware

• Ellis County, KS Official Website – Ransomware incident page ellisco.net · Advisory · 2026-09-18
• #StopRansomware Guide (CISA / MS-ISAC) CISA · Advisory · 2026-09-18
• Ransomware attack on Kansas county will affect some services databreaches.net · Blog · 2026-09-18
• Ransomware attack on Kansas county will affect some services malware.news · News · 2026-09-18
• Ransomware attack on Kansas county will affect some services ksn.com · News · 2026-09-18
• Ellis County reports ransomware incident hayspost.com · News · 2026-09-18
• Ellis County reports ransomware incident – Hays Post (syndication) hacknotice.com · News · 2026-09-18

More in ransomware

• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services

Previous and next in ransomware

• KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home Trading System (HTS) Software Previous report
• Vexy Ransomware Claims Quy Nhon University (Vietnam) — New Group, 50GB Exfiltrated Next report