Threat reportRansomwareTL-2026-3624
The Seven Deadly Sins RaaS Group - Multi-Victim Data Leak Campaign (Oct 2026)
The Seven Deadly Sins RaaS Group (TL-2026-3624) is a high-severity ransomware operation, first published 2026-10-15. It is attributed to The Seven Deadly Sins with low confidence, affects Canva Canva Pty Ltd (claimed victim; Salesforce records, enterprise, maps to 4 MITRE ATT&CK techniques (T1213, T1530, T1583), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 4MITRE ATT&CK
- Actors
- 1The Seven Deadly Sins
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-3624
- Threat ID
- TL-2026-3624
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- The Seven Deadly Sins
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, health, cannabis, government-services, consumer-iot, saas
- Target regions
- North America, 005 - South America, Oceania
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in The Seven Deadly Sins RaaS Group
Malware and tooling: Dataleak
How The Seven Deadly Sins RaaS Group works
RansomLook tracks 'The Seven Deadly Sins' as a ransomware operation that posted seven victims on its leak site on 2026-10-15, spanning SaaS, healthcare, cannabis, government-services and consumer-IoT sectors. Claimed stolen data includes customer PII, patient records, Salesforce CRM data and financial records; all claims are group-posted and unverified.
The Seven Deadly Sins is a ransomware / data-extortion group profiled by the RansomLook aggregator. As of 2026-10-15 the profile lists 7 total posts, all dated 2026-10-15, each carrying a short countdown (72 hours to contact for most victims, 60 hours for Canva Pty Ltd) typical of double-extortion pressure tactics.
Victims claimed on the leak site: Cradlewise Inc. (baby registry data, parent emails and addresses, IoT keys, e-commerce integrations; no contact), Hospital Sirio-Libanes (patient records, appointment data, FHIR/SOAP notes, health records; no contact), Globeia Inc. (government applicant data, SSNs, passport and banking details; no contact), Verano Holdings Corp. (customer credentials, loyalty data, employee records, state IDs; marked as in contact), Harness Inc. (enterprise CRM data, contact information, sales pipeline notes), iHeartJane (cannabis marketplace data, dispensary information, POS records) and Canva Pty Ltd (Salesforce records, enterprise licenses, order documentation). Row counts claimed in aggregator/search snippets range from roughly 0.9M to 19M+ rows, with the largest case exceeding 19M rows. The recurrence of Salesforce/CRM data across several postings suggests SaaS CRM environments are a targeted data source, though the intrusion vector is not stated by any source.
The group's three leak-site endpoints, one Tor onion service and two clear-web IP mirrors, were all reported as down at the time of the RansomLook snapshot. No CVE, malware family, encryptor, initial access vector, tooling or attribution (actor aliases, nation-state, affiliates) is documented in the available source. Searches for corroboration (general web search, ransomware.live, BeaconBeagle lookups for both IPs) returned nothing: the BeaconBeagle API returned HTTP 404 for 185.100.85.146 and 37.72.140.179, i.e. no C2 correlation. This record therefore relies on a single aggregator source; victim claims have not been independently verified and none of the named organizations has confirmed a breach in the sources reviewed. The 'Seven Deadly Sins' name should not be confused with unrelated 'seven deadly sins of cybersecurity' marketing reports (e.g. the SonicWall 2026 Cyber Protect Report).
MITRE ATT&CK techniques used in TL-2026-3624
Collection
T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Resource Development
Impact
Affected products and versions in The Seven Deadly Sins RaaS Group
- Canva — Canva Pty Ltd (claimed victim; Salesforce records, enterprise licenses)
- Harness — Harness Inc. (claimed victim; CRM data)
- iHeartJane — iHeartJane (claimed victim; marketplace and POS data)
- Verano Holdings — Verano Holdings Corp. (claimed victim; customer and employee data)
- Globeia — Globeia Inc. (claimed victim; applicant PII, SSNs, passports)
- Hospital Sirio-Libanes — Hospital Sirio-Libanes (claimed victim; patient records)
- Cradlewise — Cradlewise Inc. (claimed victim; registry data, IoT keys)
Remediation for The Seven Deadly Sins RaaS Group
Immediate actions
- Block the leak-site infrastructure IPs 185.100.85.146 and 37.72.140.179 at the perimeter and alert on any outbound connections to them
- Organizations named as victims should verify the claims, preserve logs and engage incident response and legal counsel
- Review Salesforce and other SaaS CRM audit logs for bulk exports, new connected apps and anomalous API or report-export activity
- Rotate credentials, API tokens and integration/IoT keys for any potentially exposed system
Workarounds
- No CVE is associated with this threat; no vendor patch applies
- Restrict SaaS API access to allow-listed IP ranges and limit report/data export permissions
Longer-term hardening
- Enforce phishing-resistant MFA and conditional access on SaaS admin and API accounts
- Apply data-loss-prevention and egress monitoring for bulk data export from CRM, EHR and customer databases
- Maintain immutable offline backups and tested restoration procedures
- Monitor ransomware leak-site aggregators for brand and vendor mentions
Timeline of The Seven Deadly Sins RaaS Group
- RansomLook reports the onion service and both clear-web mirrors (185.100.85.146, 37.72.140.179) as down at snapshot time.
- Verano Holdings Corp. posting marked 'in contact' with a 72-hour deadline; other victims show no contact.
- Salesforce and CRM data claimed from Canva Pty Ltd (60-hour deadline) and Harness Inc. (72 hours to contact).
- Claims include patient records and FHIR/SOAP notes (Hospital Sirio-Libanes) and applicant SSNs, passport and banking data (Globeia Inc.), both listed with no victim contact and a 72-hour deadline.
- Group posts seven victims on its leak site: Cradlewise Inc., Hospital Sirio-Libanes, Globeia Inc., Verano Holdings Corp., Harness Inc., iHeartJane and Canva Pty Ltd.
- RansomLook publishes The Seven Deadly Sins group profile listing 7 total posts and three leak-site endpoints.
Sources cited for The Seven Deadly Sins RaaS Group
Detection coverage for TL-2026-3624
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3624 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.