# Wallstreet Ransomware Group Lists E-Z Pack Trucks (E-Z Pack Manufacturing) as Victim

> Ransomware.live lists E-Z Pack Trucks (E-Z Pack Manufacturing), a Cynthiana, Kentucky maker of refuse and recycling truck bodies, as a victim of the Wallstreet ransomware group, discovered 2026-10-14 12:57 UTC. The claim is unconfirmed by the victim and the listing discloses no technical details.

- **Published:** 2026-10-14T13:14:57Z
- **Last reviewed:** 2026-10-14T13:14:57Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3507
- **ID:** TL-2026-3507
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Wallstreet
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-14 the ransomware tracking platform Ransomware.live recorded a new victim post by the Wallstreet extortion group naming E-Z Pack Trucks (E-Z Pack Manufacturing), a U.S. manufacturer of refuse and recycling truck bodies and related parts (front, rear and side loaders, hydraulic systems) headquartered in Cynthiana, Kentucky. The estimated attack date is 2026-10-14. The listing does not include a ransom note, data samples, a ransom amount, or any technical detail, and the victim has not confirmed the claim. Ransomware.live tags the victim with a broad multi-sector label; the company profile itself indicates manufacturing/transportation equipment.

Wallstreet is an emerging extortion group. WatchGuard dates its first appearance to April 2026 (an Indian manufacturing victim, extortion date 2026-04-13, USD 10,000 demand) and classes it as a data-broker style operation using direct extortion, double extortion and re-leaks on a Leak Bazaar-based Tor leak site. Ransomware.live records the first victim attack date as 2026-06-16, 41 confirmed victims across 10 countries (22 US, 10 Sweden), top sectors healthcare, manufacturing and professional services, and a leak site served by NGINX 1.18.0 at 4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion. Ransomware.live also lists a Tox contact identifier and correlates 26.7 percent of victims with infostealer-linked domain compromises. Secondary aggregators (not primary technical reporting) state the group gains access through compromised credentials and exposed remote-access services such as VPN and RDP; this is low-confidence and not confirmed for this victim.

Context: the same company (as E-Z Pack Holdings LLC, ezpacktrucks.com, part of Commercial Specialty Truck Holdings) was previously listed by the INC Ransom group on 2024-09-10. No relationship between the two listings is evidenced. Another Kentucky manufacturer, T.RAD North America (Hopkinsville), was listed by Wallstreet on 2026-08-10. Initial access vector, encryption behavior, and data volume for this incident are unknown. The HIGH severity is an analyst assignment, not a source-stated rating.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1021.001 Remote Services: Remote Desktop Protocol
- T1657 Financial Theft

## Sources

- [Ransomware.live - E-Z Pack Trucks victim entry (Wallstreet)](https://www.ransomware.live/id/RS1aIFBhY2sgVHJ1Y2tzQFdhbGxzdHJlZXQ=)
- [Ransomware.live - Wallstreet group profile](https://www.ransomware.live/group/wallstreet)
- [WatchGuard Ransomware Tracker - Wallstreet](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/wallstreet)
- [SOCRadar - Wallstreet ransomware group profile](https://socradar.io/free-tools/ransomware-intelligence/groups/wallstreet)
- [DeXpose - Wallstreet Ransomware Group Attacks T.RAD North America](https://www.dexpose.io/wallstreet-ransomware-group-attacks-t-rad-north-america/)
- [DeXpose - Wallstreet Ransomware Group Strikes Danvikshem in Sweden](https://www.dexpose.io/wallstreet-ransomware-group-strikes-danvikshem-in-sweden/)
- [Ransomware.live - E-Z Pack Holdings LLC (INC Ransom, 2024)](https://ransomware.live/id/RS1aIFBhY2sgSG9sZGluZ3MgTExDQGluY3JhbnNvbQ)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3507