# BYOD ransomware gang claims Michigan State University breach (1.3M current and former students)

> The BYOD ransomware and extortion gang, which emerged in September 2026, listed Michigan State University on its leak site on 2026-11-02, claiming theft of personal information on 1.3 million current and former students. MSU describes the early-October activity as a potential credential compromise event, says current evidence does not indicate a successful compromise of its central Active Directory, and required all NetID holders to reset passwords. The gang's data-theft claim is unverified.

- **Published:** 2026-11-02T20:26:23Z
- **Last reviewed:** 2026-11-02T20:26:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5092
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5092.png
- **ID:** TL-2026-5092
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** BYOD
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (1 shown free below)

## Description

On 2026-11-02 The Record from Recorded Future News reported that the BYOD ransomware gang added Michigan State University (MSU) to its Tor-based data leak site, claiming to have stolen personal information on 1.3 million current and former students. The gang announced the listing via social media. MSU said it became aware of suspicious cyber activity in early October and immediately began investigating, characterizing it as a potential credential compromise event. A campus-wide password reset email was sent on 2026-10-01; all MSU NetID holders were required to reset passwords to a minimum of 15 characters. MSU stated that current evidence does not indicate a successful compromise of its central Active Directory environment and that there is no evidence other MSU data was accessed, changed or stolen. MSU declined to comment further on the gang's claims. No ransom demand, deadline, sample data, malware, or initial access vector for the MSU incident has been published; the 1.3 million figure is the gang's assertion and has not been independently verified.

BYOD is a new ransomware and extortion group; ransomware.live lists its first victim on 2026-09-29 and 11 total victims as of 2026-11-02, with 922 GB of data reported across 4 victims. Its leak site is a Tor hidden service. Other listed victims include Trump Mobile Wireless (listed 2026-10-05), Royal Selangor (2026-10-05), T-Mobile and Gate crypto exchange (2026-10-07), Decorolala (2026-10-13), and the University of New Mexico (2026-10-26). In the Trump Mobile case the gang claimed it gained access by infecting an employee of Liberty Mobile with an infostealer that copies browser-saved passwords and session cookies, and asserted that neither company enforced multi-factor authentication; it leaked 3,615 customer records (names, emails, phone numbers, addresses, order details) and claimed retained backend access. These are the gang's own, unverified claims. Note the credential-theft pattern reported for Trump Mobile is not confirmed for MSU, where MSU's own wording (credential compromise) is the only sourced indication of access method.

The University of New Mexico Health Sciences Center incident (detected 2026-10-26 about 11:30 a.m. MDT) diverted ambulances and disrupted surgeries and classes. BYOD claimed 36,000 compromised machines across campus and hospital environments, access to Active Directory forests, Group Policy, a Microsoft Entra tenant and two Oracle databases, and theft of SSNs, HR/payroll, Banner student records, internal emails, research data and Cerner EHR rosters. A synthetic voice message was reportedly played on hospital workstations, and ransom negotiation was demanded over an encrypted messaging service. The gang announced free decryption keys for healthcare facilities (while stating it would retain stolen data) and offered up to $2,500 per affected patient; UNM stated the incident affected some end-user devices but did not penetrate core systems or servers, and said it made no concessions to the attackers. The gang describes its activity as exposing weak security and frames itself as having morals, but operates a double-extortion model (data theft plus encryption) with a public leak site. MSU previously suffered a ransomware attack by the Netwalker gang in 2020.

Severity is analyst-assigned (HIGH) based on the claimed scale of exposure (1.3M individuals) and the gang's recent record against critical-sector victims. No CVE, CVSS score, malware hashes, or network infrastructure IOCs (IPs/domains) were stated in sources for the MSU incident, so BeaconBeagle correlation had no network IOCs to query.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1213 Data from Information Repositories
- T1114 Email Collection
- T1657 Financial Theft
- T1491.001 Defacement: Internal Defacement

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5092 BYOD Credential Compromise - Password Spray With Successful Entra ID / NetID Sign-In (T1078)** (`TL-2026-5092-SPL-001`)

Detects a single source IP that fails password authentication (AADSTS50126) against 5+ distinct accounts and also achieves at least one successful sign-in in the same 24h window. MSU described the BYOD-linked October 2026 activity as a credential compromise event against NetID accounts and BYOD claims access without MFA (T1078 Valid Accounts, T1078.004 Cloud Accounts). Behaviour-first: no IOC dependency. The SPL/KQL forms apply the spray thresholds; the Sigma form is a single-event approximation (successful single-factor sign-in flagged medium/high risk).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1078, T1078.004
- **Data sources:** azure:monitor:aad (SignInLogs), Microsoft Entra ID SigninLogs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=azure sourcetype="azure:monitor:aad" category="SignInLogs" earliest=-24h | rename properties.userPrincipalName AS user, properties.ipAddress AS src_ip, properties.status.errorCode AS err_code, properties.authenticationRequirement AS auth_req, properties.appDisplayName AS app | eval failed_user=if(err_code=50126, user, null()), success_user=if(err_code=0, user, null()) | stats dc(failed_user) AS failed_users count(failed_user) AS bad_password_events dc(success_user) AS success_users values(success_user) AS compromised_candidates values(auth_req) AS auth_req values(app) AS apps min(_time) AS first_seen max(_time) AS last_seen BY src_ip | where failed_users>=5 AND bad_password_events>=10 AND success_users>=1 | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S") | table src_ip failed_users bad_password_events success_users compromised_candidates auth_req apps first_seen last_seen
```

### Microsoft KQL

```kql
SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType in ("0", "50126")
| summarize BadPasswordEvents = countif(ResultType == "50126"), FailedUsers = dcountif(UserPrincipalName, ResultType == "50126"), SuccessEvents = countif(ResultType == "0"), CompromisedCandidates = make_set_if(UserPrincipalName, ResultType == "0", 25), AuthRequirements = make_set(AuthenticationRequirement, 5), Apps = make_set(AppDisplayName, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by IPAddress
| where FailedUsers >= 5 and BadPasswordEvents >= 10 and SuccessEvents >= 1
| project IPAddress, FailedUsers, BadPasswordEvents, SuccessEvents, CompromisedCandidates, AuthRequirements, Apps, FirstSeen, LastSeen
```

### Sigma

```yaml
title: BYOD TL-2026-5092 - Risky Single-Factor Entra ID Sign-In Success (Valid Accounts)
id: 5b1d7c3e-2a94-4f6b-9c18-7e0a3d5f1b42
status: experimental
description: Detects a successful single-factor Entra ID sign-in that Entra ID Protection scored medium or high risk. Single-event approximation of the password-spray-then-success behaviour associated with the BYOD credential-compromise activity against NetID accounts; apply spray thresholds in the SPL/KQL forms.
references:
    - https://therecord.media/michigan-state-university-byod-gang-cyber-incident
    - https://www.ransomware.live/group/byod
author: Threadlinqs Team
date: 2026-11-02
tags:
    - attack.initial-access
    - attack.persistence
    - attack.t1078
    - attack.t1078.004
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        ResultType: 0
        AuthenticationRequirement: singleFactorAuthentication
        RiskLevelDuringSignIn:
            - medium
            - high
    condition: selection
falsepositives:
    - Legitimate users travelling or using a new VPN or mobile carrier
    - Service accounts excluded from MFA by policy
level: high
```

**Known false positives:**

- Shared campus NAT or VPN egress IPs where many students mistype passwords and some succeed
- Penetration tests or red-team password-spray exercises
- Onboarding waves (start of term) generating many initial password failures

**Tuning notes:** Allow-list campus NAT/VPN egress ranges and known scanners. Raise failed_users/bad_password_events for large student populations (e.g. 20/50) and lower them for staff-only tenants. Adjust the azure index and sourcetype to your Microsoft Cloud Services add-on. Prioritise hits where auth_req is singleFactorAuthentication since BYOD claims victims lacked MFA.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5092 BYOD Infostealer Session Cookie Replay - Token-Theft Risk Event or Multi-Country Session Reuse (T1539) (locked: unlock with TL Creds)
- TL-2026-5092 BYOD Bulk SharePoint / OneDrive Download for Data Theft (T1213) (locked: unlock with TL Creds)
- TL-2026-5092 BYOD Ransomware Pre-Encryption Recovery Inhibition (T1490, T1486) (locked: unlock with TL Creds)
- TL-2026-5092 BYOD Infostealer Browser Credential Store Access by Non-Browser Process (T1555.003) (locked: unlock with TL Creds)
- TL-2026-5092 BYOD Active Directory Group Policy Object Modification (T1484.001) (locked: unlock with TL Creds)
- TL-2026-5092 BYOD Synthetic Voice Ransom Message via Windows Speech API (T1491.001) (locked: unlock with TL Creds)
- TL-2026-5092 BYOD Bulk Mailbox Collection - High-Volume MailItemsAccessed by Single Account (T1114) (locked: unlock with TL Creds)
- TL-2026-5092 BYOD Leak Site / Tor Hidden Service Access From Endpoints (T1090.003, T1657) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 11)

Defanged, TLP:CLEAR.

- Domain: `byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad[.]onion`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Michigan State cyber incident claimed by ransomware gang behind recent hospital attack (The Record)](https://therecord.media/michigan-state-university-byod-gang-cyber-incident)
- [ransomware.live - BYOD group profile and victim list](https://www.ransomware.live/group/byod)
- [UNM Health ransomware attack disrupts patient care, surgeries (BleepingComputer)](https://bleepingcomputer.com/news/security/unm-health-ransomware-attack-disrupts-patient-care-surgeries)
- [UNM Health ransomware attack: BYOD 36,000 systems claim](https://tech-insider.org/unm-health-ransomware-attack-byod-36000-systems-claim-2026/)
- [Trump Mobile data breach, BYOD gang leaks 3,615 customers' records](https://pasqualepillitteri.it/en/news/20990/trump-mobile-data-breach-byod-leak)
- [Ransomware group BYOD claims Trump Mobile data breach (SC Media)](https://www.scworld.com/brief/ransomware-group-byod-claims-trump-mobile-data-breach)
- [University of New Mexico hospital diverts patients after cyber incident (The Record)](https://therecord.media/university-of-new-mexico-hospital-diverts-cyber-incident)
- [Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack (Help Net Security)](https://www.helpnetsecurity.com/?p=389301)
- [MSU provides update on IT-based intrusion (2020 Netwalker incident, prior context)](https://msutoday.msu.edu/news/2020/06/msu-provides-update-on-it-based-intrusion)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5092