BYOD ransomware gang claims Michigan State University breach (1.3M current and former students)

Key facts

Detection coverage

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5092 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5092 BYOD Credential Compromise - Password Spray With Successful Entra ID / NetID Sign-In (T1078)

Detects a single source IP that fails password authentication (AADSTS50126) against 5+ distinct accounts and also achieves at least one successful sign-in in the same 24h window. MSU described the BYOD-linked October 2026 activity as a credential compromise event against NetID accounts and BYOD claims access without MFA (T1078 Valid Accounts, T1078.004 Cloud Accounts). Behaviour-first: no IOC dependency. The SPL/KQL forms apply the spray thresholds; the Sigma form is a single-event approximation (successful single-factor sign-in flagged medium/high risk).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1078, T1078.004
• Data sources: azure:monitor:aad (SignInLogs), Microsoft Entra ID SigninLogs
• Severity: high
• Confidence: high

Splunk SPL

index=azure sourcetype="azure:monitor:aad" category="SignInLogs" earliest=-24h | rename properties.userPrincipalName AS user, properties.ipAddress AS src_ip, properties.status.errorCode AS err_code, properties.authenticationRequirement AS auth_req, properties.appDisplayName AS app | eval failed_user=if(err_code=50126, user, null()), success_user=if(err_code=0, user, null()) | stats dc(failed_user) AS failed_users count(failed_user) AS bad_password_events dc(success_user) AS success_users values(success_user) AS compromised_candidates values(auth_req) AS auth_req values(app) AS apps min(_time) AS first_seen max(_time) AS last_seen BY src_ip | where failed_users>=5 AND bad_password_events>=10 AND success_users>=1 | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S") | table src_ip failed_users bad_password_events success_users compromised_candidates auth_req apps first_seen last_seen

Microsoft KQL

SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType in ("0", "50126")
| summarize BadPasswordEvents = countif(ResultType == "50126"), FailedUsers = dcountif(UserPrincipalName, ResultType == "50126"), SuccessEvents = countif(ResultType == "0"), CompromisedCandidates = make_set_if(UserPrincipalName, ResultType == "0", 25), AuthRequirements = make_set(AuthenticationRequirement, 5), Apps = make_set(AppDisplayName, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by IPAddress
| where FailedUsers >= 5 and BadPasswordEvents >= 10 and SuccessEvents >= 1
| project IPAddress, FailedUsers, BadPasswordEvents, SuccessEvents, CompromisedCandidates, AuthRequirements, Apps, FirstSeen, LastSeen

Sigma

title: BYOD TL-2026-5092 - Risky Single-Factor Entra ID Sign-In Success (Valid Accounts)
id: 5b1d7c3e-2a94-4f6b-9c18-7e0a3d5f1b42
status: experimental
description: Detects a successful single-factor Entra ID sign-in that Entra ID Protection scored medium or high risk. Single-event approximation of the password-spray-then-success behaviour associated with the BYOD credential-compromise activity against NetID accounts; apply spray thresholds in the SPL/KQL forms.
references:
    - https://therecord.media/michigan-state-university-byod-gang-cyber-incident
    - https://www.ransomware.live/group/byod
author: Threadlinqs Team
date: 2026-11-02
tags:
    - attack.initial-access
    - attack.persistence
    - attack.t1078
    - attack.t1078.004
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        ResultType: 0
        AuthenticationRequirement: singleFactorAuthentication
        RiskLevelDuringSignIn:
            - medium
            - high
    condition: selection
falsepositives:
    - Legitimate users travelling or using a new VPN or mobile carrier
    - Service accounts excluded from MFA by policy
level: high

Known false positives:

• Shared campus NAT or VPN egress IPs where many students mistype passwords and some succeed
• Penetration tests or red-team password-spray exercises
• Onboarding waves (start of term) generating many initial password failures

Tuning notes: Allow-list campus NAT/VPN egress ranges and known scanners. Raise failed_users/bad_password_events for large student populations (e.g. 20/50) and lower them for staff-only tenants. Adjust the azure index and sourcetype to your Microsoft Cloud Services add-on. Prioritise hits where auth_req is singleFactorAuthentication since BYOD claims victims lacked MFA.

• 🔒 TL-2026-5092 BYOD Infostealer Session Cookie Replay - Token-Theft Risk Event or Multi-Country Session Reuse (T1539) · unlock with TL Creds
• 🔒 TL-2026-5092 BYOD Bulk SharePoint / OneDrive Download for Data Theft (T1213) · unlock with TL Creds
• 🔒 TL-2026-5092 BYOD Ransomware Pre-Encryption Recovery Inhibition (T1490, T1486) · unlock with TL Creds
• 🔒 TL-2026-5092 BYOD Infostealer Browser Credential Store Access by Non-Browser Process (T1555.003) · unlock with TL Creds
• 🔒 TL-2026-5092 BYOD Active Directory Group Policy Object Modification (T1484.001) · unlock with TL Creds
• 🔒 TL-2026-5092 BYOD Synthetic Voice Ransom Message via Windows Speech API (T1491.001) · unlock with TL Creds
• 🔒 TL-2026-5092 BYOD Bulk Mailbox Collection - High-Volume MailItemsAccessed by Single Account (T1114) · unlock with TL Creds
• 🔒 TL-2026-5092 BYOD Leak Site / Tor Hidden Service Access From Endpoints (T1090.003, T1657) · unlock with TL Creds

Indicators of compromise

As of 2026-11-02, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5092.

Sample indicators (1 of 11)

• Domain: byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad[.]onion

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

Community OSINT corroboration

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

The gang's data-theft claim is unverified.

On 2026-11-02 The Record from Recorded Future News reported that the BYOD ransomware gang added Michigan State University (MSU) to its Tor-based data leak site, claiming to have stolen personal information on 1.3 million current and former students. The gang announced the listing via social media. MSU said it became aware of suspicious cyber activity in early October and immediately began investigating, characterizing it as a potential credential compromise event. A campus-wide password reset email was sent on 2026-10-01; all MSU NetID holders were required to reset passwords to a minimum of 15 characters. MSU stated that current evidence does not indicate a successful compromise of its central Active Directory environment and that there is no evidence other MSU data was accessed, changed or stolen. MSU declined to comment further on the gang's claims. No ransom demand, deadline, sample data, malware, or initial access vector for the MSU incident has been published; the 1.3 million figure is the gang's assertion and has not been independently verified.

BYOD is a new ransomware and extortion group; ransomware.live lists its first victim on 2026-09-29 and 11 total victims as of 2026-11-02, with 922 GB of data reported across 4 victims. Its leak site is a Tor hidden service. Other listed victims include Trump Mobile Wireless (listed 2026-10-05), Royal Selangor (2026-10-05), T-Mobile and Gate crypto exchange (2026-10-07), Decorolala (2026-10-13), and the University of New Mexico (2026-10-26). In the Trump Mobile case the gang claimed it gained access by infecting an employee of Liberty Mobile with an infostealer that copies browser-saved passwords and session cookies, and asserted that neither company enforced multi-factor authentication; it leaked 3,615 customer records (names, emails, phone numbers, addresses, order details) and claimed retained backend access. These are the gang's own, unverified claims. Note the credential-theft pattern reported for Trump Mobile is not confirmed for MSU, where MSU's own wording (credential compromise) is the only sourced indication of access method.

The University of New Mexico Health Sciences Center incident (detected 2026-10-26 about 11:30 a.m. MDT) diverted ambulances and disrupted surgeries and classes. BYOD claimed 36,000 compromised machines across campus and hospital environments, access to Active Directory forests, Group Policy, a Microsoft Entra tenant and two Oracle databases, and theft of SSNs, HR/payroll, Banner student records, internal emails, research data and Cerner EHR rosters. A synthetic voice message was reportedly played on hospital workstations, and ransom negotiation was demanded over an encrypted messaging service. The gang announced free decryption keys for healthcare facilities (while stating it would retain stolen data) and offered up to $2,500 per affected patient; UNM stated the incident affected some end-user devices but did not penetrate core systems or servers, and said it made no concessions to the attackers. The gang describes its activity as exposing weak security and frames itself as having morals, but operates a double-extortion model (data theft plus encryption) with a public leak site. MSU previously suffered a ransomware attack by the Netwalker gang in 2020.

Severity is analyst-assigned (HIGH) based on the claimed scale of exposure (1.3M individuals) and the gang's recent record against critical-sector victims. No CVE, CVSS score, malware hashes, or network infrastructure IOCs (IPs/domains) were stated in sources for the MSU incident, so BeaconBeagle correlation had no network IOCs to query.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts

Collection

T1114 Email Collection; T1213 Data from Information Repositories

Impact

T1491.001 Defacement: Internal Defacement; T1657 Financial Theft

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Remediation

Immediate actions

• Force password resets for affected identity populations (MSU required 15+ character passwords for all NetID holders) and revoke active sessions and tokens
• Hunt for anomalous sign-ins to student, employee and SSO accounts, especially from new devices or locations, since the activity is described as credential compromise
• Audit privileged and Active Directory/Entra accounts for unauthorized changes and review Group Policy changes
• Monitor the BYOD leak site and ransomware tracking feeds for posted data samples relating to your organization

Workarounds

• No vulnerability is implicated; rely on credential hygiene, MFA enforcement and session revocation

Longer-term hardening

• Enforce phishing-resistant multi-factor authentication on all remote, SSO and email access
• Deploy infostealer detection and browser credential/session-cookie protections on endpoints; shorten session lifetimes
• Segment campus, hospital and identity infrastructure and maintain offline, tested backups
• Minimize retention of student and employee PII (including SSNs) in systems exposed to credential-based access

Affected and fixed versions

• Michigan State University — MSU NetID identity and credential environment
• University of New Mexico — UNM Health Sciences Center (separate BYOD incident, claimed)

Timeline

• 2020-06-01 MSU previously suffered a ransomware attack by the Netwalker gang (prior context; no stated link to BYOD)
• 2026-09-29 BYOD's first victim date per ransomware.live; estimated Trump Mobile incident date after the gang emerged in September
• 2026-10-01 MSU sent a campus password reset email after detecting suspicious activity it described as a potential credential compromise event; NetID holders required to set 15+ character passwords
• 2026-10-05 BYOD leaked 3,615 Trump Mobile customer records, claiming access via a Liberty Mobile employee infected with an infostealer
• 2026-10-26 University of New Mexico Health Sciences Center detected a cybersecurity event around 11:30 a.m. MDT, diverting ambulances; BYOD listed UNM on its leak site claiming 36,000 compromised machines
• 2026-10-27 BYOD announced free decryption keys for healthcare facilities and offered up to $2,500 per affected patient while stating it would retain stolen data
• 2026-11-02 BYOD added Michigan State University to its leak site, claiming theft of data on 1.3 million current and former students; MSU said evidence does not indicate compromise of its central Active Directory

Sources cited

• ransomware.live - BYOD group profile and victim list ransomware.live · Research · 2026-11-02
• MSU provides update on IT-based intrusion (2020 Netwalker incident, prior context) msutoday.msu.edu · Vendor report · 2020-06-01
• Michigan State cyber incident claimed by ransomware gang behind recent hospital attack (The Record) The Record · News · 2026-11-02
• UNM Health ransomware attack disrupts patient care, surgeries (BleepingComputer) BleepingComputer · News · 2026-10-27
• UNM Health ransomware attack: BYOD 36,000 systems claim tech-insider.org · News · 2026-10-27
• Trump Mobile data breach, BYOD gang leaks 3,615 customers' records pasqualepillitteri.it · News · 2026-10-05
• Ransomware group BYOD claims Trump Mobile data breach (SC Media) scworld.com · News
• University of New Mexico hospital diverts patients after cyber incident (The Record) The Record · News
• Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack (Help Net Security) Help Net Security · News

More in ransomware

• Vanderbilt University hit in BYOD ransomware attack, data theft claimed
• Vexy Ransomware lists Living Word Schools (US education) as victim
• Vexy Ransomware claims Albion Online Data Project (16 GB exfiltrated)
• Halcyon August 2026 Ransomware Report: 10 of Top 15 Families New vs. July; Manufacturing Top Target
• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing

More from BYOD

• Ransomware Attack on UNM Health Cancels Surgeries and Diverts Ambulances (BYOD Group Attributed)
• BYOD Ransomware Group Claims Trump Mobile Customer Data Breach via Liberty Mobile Employee Malware Infection

Previous and next in ransomware

• C3RB3R (Cerber-variant) Ransomware Campaign Against Internet-Exposed Synology NAS Devices (Unpatched / End-of-Life DSM; Disputed Entry Vector: CVE-2024-10441 vs CVE-2026-13639 / CVE-2026-13684) Previous report
• Ransomware Targeting of Small and Medium-Sized Businesses: Credential Theft, Unpatched Edge Devices, BYOVD and Backup Targeting Next report