Threat reportRansomwareTL-2026-4965
WhiteArmor ransomware/extortion group claims Hisense data theft (19 GB) and demands $5 million in Bitcoin
WhiteArmor ransomware/extortion group claims Hisense data (TL-2026-4965), also tracked as WhiteArmor Hisense extortion, is a high-severity ransomware operation, first published 2026-11-01. It is attributed to WhiteArmor with low confidence, affects Hisense GCRM production document store, Malaysia/Singapore, maps to 5 MITRE ATT&CK techniques (T1078, T1213, T1567), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 1WhiteArmor
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-4965
- Threat ID
- TL-2026-4965
- Also known as
- WhiteArmor Hisense extortion
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- WhiteArmor
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, logistics, finance, news - media, construction, gaming
- Target regions
- malaysia, singapore, North America, china, brazil, indonesia
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in WhiteArmor ransomware/extortion group claims Hisense data
Malware and tooling: WHIRLPOOL
How WhiteArmor ransomware/extortion group claims Hisense data works
Newly emerged extortion group WhiteArmor claims to have stolen 19 GB from Hisense, including Malaysia/Singapore warranty-claims data, customer PII, 2,549 supplier records and the internal CRM application binary, and demands $5 million in Bitcoin. Hisense has not commented and the claim is unverified.
WhiteArmor is a newly emerged data-theft and extortion group that runs a Tor leak site and advertises an affiliate programme in which affiliates keep 95% of successful ransom payments and the operators take 5%. Its first tracked victim listing was on 2026-10-21 (Breachsense records 2026-10-22). Six victims were listed when the Hisense claim was reported on 2026-10-27, and Breachsense listed 12 by 2026-10-31. Named victims include KTU Shipyard, Echo Global Logistics, J.B. Hunt Transport Services, Hisense, Whirlpool, KuCoin, Ryder System and Gamdom. Sectors with identifiable victims are logistics, manufacturing, media, financial services and construction. The group reportedly seeks penetration testers, web-exploitation experts and zero-day researchers (unverified recruitment claim).
On 2026-10-26 the group posted Hisense, a Chinese electronics manufacturer, on its leak site with a countdown timer of more than 28 days and a $5,000,000 Bitcoin demand (reportedly raised from $500,000). It claims 19 GB of data: the GCRM production document store; the full Malaysia/Singapore warranty-claims archive; customer names, phone numbers, email addresses and ID numbers; information on 2,549 suppliers; hundreds of invoices, payment records and contracts; return-merchandise (RMA) forms and claim evidence; and the internal CRM application binary. A 348 KB proof sample was released, but the host serving it was unresponsive at the time of reporting. Researcher Aras Nazarovas assessed the impact as limited to Malaysia/Singapore warranty claims plus customer details, mainly PII, and noted that the CRM binary could be reverse-engineered to facilitate return fraud. Hisense has issued no statement and no independent verification exists.
Access method for Hisense is not disclosed. For another victim, Gamdom, press reporting states the group claims 15,420,003 accounts across 146 database columns, demands $15 million in Bitcoin, and published a 437 KB JSON file with 100 sample accounts. The reported access path was an old internal machine account linked to Metawin that had administrative reach, was never rotated and exposed internal control panels and stored secrets. Gamdom's founder disputes the scale of the claim. One source notes a possible connection to a group called 'WhiteArmour' that claimed Disney data on 2026-10-22; this link is unconfirmed. No malware family, encryptor, CVE or technical IOC (IP, hash) has been published for the Hisense claim. The observed activity is data theft and extortion; file encryption is not evidenced.
MITRE ATT&CK techniques used in TL-2026-4965
Initial Access
Collection
T1213 Data from Information Repositories
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Impact
Affected products and versions in WhiteArmor ransomware/extortion group claims Hisense data
- Hisense — GCRM production document store, Malaysia/Singapore warranty-claims archive, internal CRM application (claimed)
Remediation for WhiteArmor ransomware/extortion group claims Hisense data
Immediate actions
- Hisense-related parties: treat claimed customer and supplier data as potentially exposed and monitor for phishing and return-fraud abuse
- Block and alert on access to the WhiteArmor Tor leak site from corporate networks
- Audit and rotate stale or never-rotated machine and service accounts, especially those with administrative reach to internal control panels and secrets stores
- Review document stores and CRM/warranty systems for unusual bulk access or large outbound transfers
Workarounds
- Notify affected customers and suppliers if the breach is confirmed and advise vigilance against phishing and fraudulent return claims
Longer-term hardening
- Inventory and retire legacy internal accounts; enforce credential rotation and least privilege for service accounts
- Restrict and monitor access to internal CRM, document management and RMA systems; protect application binaries and source from broad internal access
- Deploy data-loss and egress monitoring for large exfiltration volumes
- Maintain tested incident-response and breach-notification procedures for PII exposure
Timeline of WhiteArmor ransomware/extortion group claims Hisense data
- Gamdom detects a breach of its hot wallet system (separate earlier incident, reported ~$3 million loss); later linked in press to WhiteArmor's Gamdom extortion claim
- WhiteArmor first appears in tracked victim listings (Breachsense records the first victim as 2026-10-22)
- A group named 'WhiteArmour' claims Disney data; possible connection to WhiteArmor is unconfirmed
- WhiteArmor posts a $15 million Bitcoin demand against Gamdom, claiming 15,420,003 accounts; a 437 KB JSON sample of 100 accounts is published
- WhiteArmor posts Hisense on its leak site with a 28+ day countdown and a $5 million Bitcoin demand (reportedly raised from $500,000); 19 GB claimed, 348 KB sample released
- teiss, Daily Security Review and Cybernews report the Hisense claim; Hisense issues no statement and the sample host is unresponsive; six victims are listed on the leak site
- Breachsense records the most recent WhiteArmor victim posting, with 12 victims listed on the leak site
Sources cited for WhiteArmor ransomware/extortion group claims Hisense data
- WhiteArmor ransomware group claims Hisense data theft, demands $5 million
- WhiteArmor Gang Claims 19GB Hisense Data Theft, Demands $5 Million
- Hisense faces $5 million ransom demand over alleged 19GB data theft
- WhiteArmor Demands $15M Bitcoin From Gamdom
- Breachsense: WhiteArmor ransomware group profile
- SOCRadar Ransomware Intelligence: Hisense / WhiteArmor
- Malpedia library entry: WhiteArmor ransomware group claims Hisense data theft
Detection coverage for TL-2026-4965
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4965 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.