# Emperador ransomware group claims A-RMS (Technology) - server encryption and source code theft

> Ransomware.live lists A-RMS, a technology-sector organization, as a victim of the Emperador ransomware/extortion group, discovered 2026-10-25. The actors claim to have encrypted servers and stolen source code and sensitive information (35.5 MB) and threaten to contact and attack the victim's employees, clients and partners if the ransom is not paid.

- **Published:** 2026-10-25T15:06:31Z
- **Last reviewed:** 2026-10-25T15:06:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4421
- **ID:** TL-2026-4421
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Emperador
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-25 at 14:52 UTC, the ransomware leak-site tracker Ransomware.live indexed a new Emperador listing naming A-RMS (sector: Technology) as a victim. The estimated attack date is 2026-10-25. The extortion message quoted on the victim page states the actors 'encrypted your servers and stole some of your source code, along with sensitive information' and threatens to 'contact and attack your employees, clients, and partners to destroy your business'. The listing records 35.5 MB of exfiltrated data and a posted leak screenshot. The victim's country is not specified. The claim is actor-asserted and has not been confirmed by the victim or a vendor; no initial access vector, tooling, file hashes or network indicators specific to this intrusion are public.

Emperador is a recently emerged group. SOCRadar describes it as a financially motivated, double-extortion operation first observed in August 2026 that runs a dedicated dark-web leak site, lists Russia as the assessed origin, and counts 73 claimed victims through October 2026 (peak of 48 in August). Ransomware.live's group profile is lower: 52 victims across 19 countries since an estimated first attack on 2026-08-10 (first discovery 2026-08-12), 567.1 GB exfiltrated across 48 victims, with Brazil (8), United States (5), Germany (3), Argentina and Turkey (2 each) most affected, and Manufacturing, Government & Defense, Transportation, Technology and Energy the leading sectors. The two trackers differ on counts and on regional focus (SOCRadar emphasizes Asia-Pacific municipal entities), so victim statistics should be treated as approximate. Other recent listings include AB InBev, Phoenix S&S GmbH and Frommann Energie GmbH.

SOCRadar reports typical access methods of phishing, exploitation of exposed VPN appliances and reuse of compromised credentials, and maps group TTPs to Impair Defenses, Ingress Tool Transfer, WMI, Command and Scripting Interpreter, Data Encrypted for Impact, Inhibit System Recovery, Remote Services/RDP, Valid Accounts and Boot or Logon Autostart Execution. SOCRadar states there is not enough public evidence to determine whether Emperador uses its own encryptor or reused tooling, and no technical lineage to a known ransomware family is confirmed. Ransomware.live's group page also lists CVEs associated with the group (ConnectWise ScreenConnect CVE-2024-1708, Exchange CVE-2023-21529, Check Point IKEv1 CVE-2026-50751, Nx Console CVE-2026-48027, Windows link following CVE-2025-60710); these are group-level associations from a single tracker and are not tied to the A-RMS intrusion, so they are recorded as IOC context and not in this threat's CVE list. A BeaconBeagle config search for the group's leak-site domain returned no matches.

## MITRE ATT&CK

- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1547 Boot or Logon Autostart Execution
- T1047 Windows Management Instrumentation
- T1059 Command and Scripting Interpreter
- T1685 Disable or Modify Tools
- T1021 Remote Services
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Sources

- [Ransomware.live - A-RMS victim page (Emperador)](https://www.ransomware.live/id/QS1STVNAZW1wZXJhZG9y)
- [Ransomware.live - Emperador group profile](https://www.ransomware.live/group/emperador)
- [SOCRadar - Emperador ransomware group profile](https://socradar.io/free-tools/ransomware-intelligence/groups/emperador)
- [Dark Web Intelligence - New Ransomware Group Emerges: Emperador](https://x.com/DailyDarkWeb/status/2091207017285177702)
- [SOCRadar - Bosnia and Herzegovina Mine Action Center Data Breach (Emperador)](https://socradar.io/data-breach/bosnia-and-herzegovina-mine-action-center-emperador-ransomware-2026/)
- [SOCRadar - FRUCASTRO SL Data Breach (Emperador)](https://socradar.io/blog/data-breach/frucastro-sl-emperador-ransomware-2026/)
- [SOCRadar - BAYMER Data Breach (Emperador)](https://socradar.io/data-breach/baymer-emperador-ransomware-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4421