# Emperador Ransomware Group Claims 3.9GB Data Theft from AB InBev (Budweiser, Corona Maker) - Unverified $1M Bitcoin Extortion

> The Emperador extortion group listed AB InBev on its Tor leak site on 2026-10-25, claiming 3.9GB of stolen data and demanding $1 million in Bitcoin. AB InBev has not confirmed a breach, and no evidence of encryption, operational disruption or access method has been published.

- **Published:** 2026-10-26T17:21:46Z
- **Last reviewed:** 2026-10-26T17:21:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4469
- **ID:** TL-2026-4469
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** TRACKING
- **Actor:** Emperador
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-50751, CVE-2026-48027, CVE-2023-21529, CVE-2024-1708, CVE-2025-60710

## Description

On 2026-10-25 at 03:22 UTC the Emperador ransomware/extortion group posted AB InBev, the brewer behind Budweiser, Corona and Stella Artois, on its dark-web leak site; the entry was picked up by the Ransomware.live victim tracker and reported by Cyber Security News on 2026-10-26. The group claims possession of about 3.9GB of data: 329,244 social-listening alerts, 2,510 corporate emails across AB InBev subsidiaries, roughly 19,000 access logs, Global Business Services (GBS) portal records, internal public key infrastructure (PKI) certificates, and 3.2GB of Azure Blob assets. It demands $1 million in Bitcoin.

The claim is UNVERIFIED. No AB InBev statement or confirmation has been reported, and the reporting notes that the claim lacks authentication evidence, ownership confirmation or access-method documentation. It is not stated whether private keys accompany the PKI certificates, nothing explains what the Azure Blob assets contain or whether any storage account, token or credential was compromised, the number of affected individuals is unknown, and there is no proof of system encryption, disruption or ransomware deployment. A leak-site listing alone is not proof of ransomware execution; this record therefore treats the event as an extortion claim and is rated conservatively. Independent searches found no corroborating reporting of the AB InBev claim beyond the original article and the tracker listing.

Context on the actor: Emperador emerged in mid-2026 (WatchGuard tracker: first seen July 2026; Ransomware.live: first victim 2026-08-10, listed 2026-08-12). Public trackers describe a financially motivated double-extortion operation with a Tor leak site (emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion). WatchGuard describes a builder-based RaaS-style crypto-ransomware using ChaCha20 symmetric encryption and appending a 15-random-character file extension, with Session Messenger and Tox contact IDs. Ransomware.live reports victims across about 19 countries (Brazil, United States, Germany, Mexico, Argentina most frequent) and sectors including manufacturing, transportation, government and defense, technology and energy; victim totals differ between trackers (53 on the Ransomware.live group page at fetch time, 73 in a search-result snippet), so counts should be treated as approximate. Named victims include the City Government of Baguio (Philippines, 2026-08-12, ~2.9GB leaked), NetExam (2026-08-20), and Brazil's Receita Federal (2026-09-23).

Ransomware.live additionally lists five CVEs as exploited by the group: CVE-2026-50751 (Check Point Security Gateway IKEv1 remote-access VPN authentication bypass, CVSS 9.3, exploited as a zero-day and also linked by Check Point to a Qilin affiliate), CVE-2026-48027 (malicious Nx Console 18.95.0 extension release, 2026-05-19), CVE-2023-21529 (Microsoft Exchange), CVE-2024-1708 (ConnectWise ScreenConnect) and CVE-2025-60710 (Windows). This is a single-tracker attribution of group-level tooling; no source links any of these CVEs to the AB InBev claim, and the initial access vector for AB InBev is unknown. Defenders should treat the CVEs as group-level hunting leads only.

No clearnet IPs, domains or file hashes have been published for this claim, so there was nothing to submit to BeaconBeagle; the only network indicator is the Tor onion address, which is outside BeaconBeagle's IP/domain lookups.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1219 Remote Access Tools
- T1552.004 Private Keys
- T1530 Data from Cloud Storage
- T1114 Email Collection
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Emperador Ransomware Group Claims to Have Stolen 3.9GB of Data from the Maker of Budweiser and Corona](https://cybersecuritynews.com/emperador-ransomware-group-claim/)
- [Ransomware.live - Emperador group profile](https://ransomware.live/group/Emperador)
- [WatchGuard Ransomware Tracker - Emperador](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/emperador)
- [SOCRadar - Emperador ransomware group intelligence](https://socradar.io/free-tools/ransomware-intelligence/groups/emperador)
- [SOCRadar - RECEITA FEDERAL DO BRASIL data breach (Emperador)](https://socradar.io/blog/data-breach/receita-federal-do-brasil-emperador-ransomware-2026/)
- [DeXpose - Emperador ransomware attack targets City Government of Baguio](https://www.dexpose.io/?p=41220)
- [ManageEngine - Zero-Day Alert: Check Point Security Gateway Authentication Bypass CVE-2026-50751](https://pitstop.manageengine.com/portal/en/community/topic/zero-day-alert-check-point-security-gateway-authentication-bypass-vulnerability-cve-2026-50751-11-6-2026)
- [NVD - CVE-2026-48027 (Nx Console)](https://nvd.nist.gov/vuln/detail/CVE-2026-48027)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4469