Threat reportRansomwareTL-2026-3507
Wallstreet Ransomware Group Lists E-Z Pack Trucks (E-Z Pack Manufacturing) as Victim
Wallstreet Ransomware Group Lists E-Z Pack Trucks (E-Z Pack (TL-2026-3507) is a high-severity ransomware operation, first published 2026-10-14. It is attributed to Wallstreet with low confidence, affects E-Z Pack Manufacturing Corporate IT environment (E-Z Pack Trucks, maps to 4 MITRE ATT&CK techniques (T1021.001, T1078, T1133), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 4MITRE ATT&CK
- Actors
- 1Wallstreet
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-3507
- Threat ID
- TL-2026-3507
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Wallstreet
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, transport, health, professional-services
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Wallstreet Ransomware Group Lists E-Z Pack Trucks (E-Z Pack
Malware and tooling: Wallstreet, inc ransom, leak bazaar
How Wallstreet Ransomware Group Lists E-Z Pack Trucks (E-Z Pack works
Ransomware.live lists E-Z Pack Trucks (E-Z Pack Manufacturing), a Cynthiana, Kentucky maker of refuse and recycling truck bodies, as a victim of the Wallstreet ransomware group, discovered 2026-10-14 12:57 UTC. The claim is unconfirmed by the victim and the listing discloses no technical details.
On 2026-10-14 the ransomware tracking platform Ransomware.live recorded a new victim post by the Wallstreet extortion group naming E-Z Pack Trucks (E-Z Pack Manufacturing), a U.S. manufacturer of refuse and recycling truck bodies and related parts (front, rear and side loaders, hydraulic systems) headquartered in Cynthiana, Kentucky. The estimated attack date is 2026-10-14. The listing does not include a ransom note, data samples, a ransom amount, or any technical detail, and the victim has not confirmed the claim. Ransomware.live tags the victim with a broad multi-sector label; the company profile itself indicates manufacturing/transportation equipment.
Wallstreet is an emerging extortion group. WatchGuard dates its first appearance to April 2026 (an Indian manufacturing victim, extortion date 2026-04-13, USD 10,000 demand) and classes it as a data-broker style operation using direct extortion, double extortion and re-leaks on a Leak Bazaar-based Tor leak site. Ransomware.live records the first victim attack date as 2026-06-16, 41 confirmed victims across 10 countries (22 US, 10 Sweden), top sectors healthcare, manufacturing and professional services, and a leak site served by NGINX 1.18.0 at 4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion. Ransomware.live also lists a Tox contact identifier and correlates 26.7 percent of victims with infostealer-linked domain compromises. Secondary aggregators (not primary technical reporting) state the group gains access through compromised credentials and exposed remote-access services such as VPN and RDP; this is low-confidence and not confirmed for this victim.
Context: the same company (as E-Z Pack Holdings LLC, ezpacktrucks.com, part of Commercial Specialty Truck Holdings) was previously listed by the INC Ransom group on 2024-09-10. No relationship between the two listings is evidenced. Another Kentucky manufacturer, T.RAD North America (Hopkinsville), was listed by Wallstreet on 2026-08-10. Initial access vector, encryption behavior, and data volume for this incident are unknown. The HIGH severity is an analyst assignment, not a source-stated rating.
MITRE ATT&CK techniques used in TL-2026-3507
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol
Initial Access
T1078 Valid Accounts; T1133 External Remote Services
Impact
Affected products and versions in Wallstreet Ransomware Group Lists E-Z Pack Trucks (E-Z Pack
- E-Z Pack Manufacturing — Corporate IT environment (E-Z Pack Trucks, Cynthiana, Kentucky; part of Commercial Specialty Truck Holdings)
Remediation for Wallstreet Ransomware Group Lists E-Z Pack Trucks (E-Z Pack
Immediate actions
- Validate the claim with E-Z Pack/CSTH incident response and review VPN, RDP and remote-access logs for anomalous logins
- Reset credentials and enforce MFA on all remote-access and SSO accounts, prioritising any appearing in infostealer logs
- Monitor for outbound Tor and Tox protocol traffic from corporate networks
- Preserve forensic evidence and isolate any hosts showing encryption or mass-exfiltration activity
Workarounds
- Disable or tightly filter internet-facing RDP; require VPN with MFA for remote administration
Longer-term hardening
- Restrict external RDP/VPN exposure and apply conditional access and geo/IP restrictions
- Maintain offline, immutable backups and test restoration
- Monitor dark-web leak sites and infostealer exposure for organisation and supplier domains
- Deploy EDR with behavioral detection for bulk file staging and exfiltration
Timeline of Wallstreet Ransomware Group Lists E-Z Pack Trucks (E-Z Pack
- E-Z Pack Holdings LLC (ezpacktrucks.com) previously listed by the INC Ransom group on ransomware.live; no link to the 2026 listing is evidenced
- Wallstreet first appears per WatchGuard tracker (Indian manufacturing victim, USD 10,000 extortion)
- Ransomware.live records the estimated attack date of Wallstreet's first victim
- First Wallstreet victim discovered by ransomware.live
- Wallstreet lists T.RAD North America, a Hopkinsville, Kentucky heat-exchanger manufacturer
- Wallstreet claims Swedish victims Danvikshem, Mantum Holding AB and Vendus Sweden AB
- E-Z Pack Trucks (E-Z Pack Manufacturing) listed as a Wallstreet victim; discovered 12:57 UTC, estimated attack date 2026-10-14
Sources cited for Wallstreet Ransomware Group Lists E-Z Pack Trucks (E-Z Pack
- Ransomware.live - E-Z Pack Trucks victim entry (Wallstreet)
- Ransomware.live - Wallstreet group profile
- WatchGuard Ransomware Tracker - Wallstreet
- SOCRadar - Wallstreet ransomware group profile
- DeXpose - Wallstreet Ransomware Group Attacks T.RAD North America
- DeXpose - Wallstreet Ransomware Group Strikes Danvikshem in Sweden
- Ransomware.live - E-Z Pack Holdings LLC (INC Ransom, 2024)
Detection coverage for TL-2026-3507
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3507 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3507
2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.