# Whitearmor (emerging ransomware group) 'Project Trojan Horse' - initial access sales and insider recruitment

> Whitearmor, a ransomware/data-extortion group first active in October 2026, posted 'Project Trojan Horse' (listed by ransomware.live on 2026-11-03) advertising initial access sales for companies above $500M revenue (excluding the CIS region) and recruiting insiders. Targeted access includes Okta, Azure, IAM Root, CRM tools, Jenkins and VPNs (Forti, AnyConnect, Citrix, Sonicwall).

- **Published:** 2026-11-04T00:10:45Z
- **Last reviewed:** 2026-11-04T00:10:45Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5190
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5190.png
- **ID:** TL-2026-5190
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** WhiteArmor
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (2 shown free below)

## Description

Whitearmor (also written WhiteArmor) is an emerging ransomware and data-extortion group. Trackers date its first claimed victims to 2026-10-20/22 and describe it as a crypto-ransomware operation using direct extortion, double extortion and free data leaks, with ransom demands reported between $140,000 and $20,000,000 payable in BTC or XMR. It operates a Tor leak site and a clearnet site (whitearmor.cc). Trackers report between 11 and 19 victims depending on the snapshot, mainly US-based, with victims also in China, Brazil, Indonesia, Philippines, Germany, Argentina, Iceland and Curacao, concentrated in logistics/transportation, manufacturing, technology, retail and media.

On 2026-11-03 ransomware.live listed a post titled 'Project Trojan Horse' attributed to Whitearmor. The post advertises the sale of initial access to organizations ('working with all kinds of accesses depending on said target'), with a minimum company revenue threshold of $500M and a geographic exclusion of the CIS region. Preferred access types named are identity and cloud platforms (Okta, Azure, IAM Root), CRM tools, the Jenkins CI/CD server, and VPN access (Fortinet, Cisco AnyConnect, Citrix, SonicWall). The group also recruits employees/insiders. ransomware.live lists 12 target sectors: Agriculture, Education, Energy & Utilities, Financial Services, Government & Defense, Healthcare, Hospitality, Manufacturing, Professional Services, Retail & E-Commerce, Technology and Transportation, with specific interest in edtech, enterprise software, insurance, hotels, telecommunications, finance, retail, automotive, transportation and logistics.

This post indicates Whitearmor is moving to broker or buy access (and insider-enabled access) in addition to its own extortion operations, a model that bypasses perimeter exploitation and relies on valid credentials, sessions and trusted-insider actions. No CVEs, malware hashes, C2 IPs or technical TTPs were published by any source reviewed; the MITRE mapping below is limited to behaviors directly evidenced by the advertisement and by tracker descriptions of the group's extortion model. Source discrepancies: contact handles differ between trackers (Telegram @whitearmorsupp per ransomware.live Project Trojan Horse post; @whitearmorxd and X @WhiteArmorxd per WatchGuard), and victim counts and first-seen dates vary by tracker (Oct 20-22, 2026). Single-source for the Project Trojan Horse post itself (ransomware.live). No BeaconBeagle C2 correlation was available (lookup for whitearmor.cc returned HTTP 502; no IP IOCs exist).

## MITRE ATT&CK

- T1650 Acquire Access
- T1078 Valid Accounts
- T1078.004 Valid Accounts: Cloud Accounts
- T1133 External Remote Services
- T1133 External Remote Services
- T1078 Valid Accounts
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**WhiteArmor Project Trojan Horse - Okta Session Established After MFA Failure/Push-Deny Burst (Valid Account Takeover)** (`TL-2026-5190-SPL-001`)

TL-2026-5190: WhiteArmor's 'Project Trojan Horse' advertises initial access to Okta and other identity platforms. Access brokers and recruited insiders typically reach a working Okta session via valid credentials and MFA fatigue or bypass. This search flags a user who accumulates 3+ MFA failures, push denials or bypass attempts within a 30-minute window and then obtains a successful Okta session (T1078 / T1078.004), the pattern left by a takeover of a corporate identity.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1078, T1078.004, T1621
- **Data sources:** okta:OktaIM2:log, azure:SigninLogs, okta system log
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=okta sourcetype="OktaIM2:log" earliest=-24h
    (eventType="user.session.start" OR eventType="user.authentication.auth_via_mfa" OR eventType="user.mfa.okta_verify.deny_push" OR eventType="user.mfa.attempt_bypass")
| eval is_fail=if(eventType IN ("user.mfa.okta_verify.deny_push","user.mfa.attempt_bypass") OR (eventType="user.authentication.auth_via_mfa" AND 'outcome.result'="FAILURE"), 1, 0)
| eval is_success=if(eventType="user.session.start" AND 'outcome.result'="SUCCESS", 1, 0)
| bin _time span=30m
| stats sum(is_fail) AS mfa_fail_or_deny sum(is_success) AS successful_sessions dc(client.geographicalContext.country) AS countries values(client.ipAddress) AS src_ips values(client.userAgent.rawUserAgent) AS user_agents BY _time actor.alternateId
| where mfa_fail_or_deny>=3 AND successful_sessions>=1
| eval threat="TL-2026-5190 WhiteArmor Project Trojan Horse - T1078.004 Okta valid-account takeover"
| sort - mfa_fail_or_deny
```

### Microsoft KQL

```kql
let lookback = 24h;
let window = 30m;
// Entra ID ResultTypes: 50074/50076 MFA required, 500121 MFA failed, 50158 external challenge, 50072 MFA enrolment prompt
SigninLogs
| where TimeGenerated > ago(lookback)
| where UserType == "Member"
| extend IsFail = iff(ResultType in ("50074","50076","500121","50158","50072"), 1, 0)
| extend IsSuccess = iff(ResultType == "0", 1, 0)
| extend Country = tostring(LocationDetails.countryOrRegion)
| summarize MfaFailures = sum(IsFail), Successes = sum(IsSuccess), Countries = dcount(Country), SourceIPs = make_set(IPAddress, 10), Apps = make_set(AppDisplayName, 10) by UserPrincipalName, bin(TimeGenerated, window)
| where MfaFailures >= 3 and Successes >= 1
| project TimeGenerated, UserPrincipalName, MfaFailures, Successes, Countries, SourceIPs, Apps
| order by MfaFailures desc
```

### Sigma

```yaml
title: Okta MFA Push Denied or Bypass Attempt - WhiteArmor Valid Account Takeover Precursor
id: 5b0e4a1c-8d3f-4a62-9c71-3f5e2a9d1b01
status: experimental
description: Detects Okta MFA push denials and MFA bypass attempts, the user-visible precursor to session takeover of an Okta identity as advertised in WhiteArmor's Project Trojan Horse (TL-2026-5190). Alert on bursts per user.
references:
    - https://www.ransomware.live/group/whitearmor
    - https://www.ransomware.live/id/UHJvamVjdCBUcm9qYW4gSG9yc2VAV2hpdGVhcm1vcg
    - https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/whitearmor
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.initial_access
    - attack.credential_access
    - attack.t1078.004
    - attack.t1621
logsource:
    product: okta
    service: okta
detection:
    selection:
        eventtype:
            - 'user.mfa.okta_verify.deny_push'
            - 'user.mfa.attempt_bypass'
    condition: selection
falsepositives:
    - Users who mistakenly deny a legitimate push prompt
    - Users changing phones or re-enrolling authenticators
level: medium

```

**Known false positives:**

- Users who mistakenly deny a legitimate push prompt then re-authenticate successfully
- Users on new phones or travelling with poor connectivity who trigger repeated MFA failures
- Automated test accounts or service accounts with scripted authentication

**Tuning notes:** Raise or lower the threshold of 3 per 30 minutes to suit your baseline. Exclude known service accounts and scripted test users. Enrich with network zone and device-trust fields and prioritise results where the successful session is from a new country or an unmanaged device. Apply stricter handling to privileged and admin-group users.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- WhiteArmor Project Trojan Horse - Entra ID Successful Sign-In From a Country Not Seen for the User in 14 Days (locked: unlock with TL Creds)
- WhiteArmor Project Trojan Horse - Azure Root/Subscription-Scope Role Assignment or Global Admin Access Elevation (locked: unlock with TL Creds)
- WhiteArmor Insider Recruitment / Data Extortion - Bulk SharePoint and OneDrive File Download by a Single User (locked: unlock with TL Creds)
- WhiteArmor Project Trojan Horse - FortiGate Admin Login From External IP or VPN Success After Failures (locked: unlock with TL Creds)
- WhiteArmor Project Trojan Horse - Jenkins Script Console, Plugin Upload or Credential Store Access (locked: unlock with TL Creds)
- WhiteArmor Crypto-Ransomware Impact Precursor - Shadow Copy, Backup Catalog and Boot Recovery Destruction (locked: unlock with TL Creds)
- WhiteArmor Project Trojan Horse - Okta Persistence via New MFA Factor, API Token, Admin Grant or Policy Weakening (locked: unlock with TL Creds)
- WhiteArmor Leak-Site and Access-Broker Contact Infrastructure Access ([indicator], Tor onion, Telegram [indicator]) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 16)

Defanged, TLP:CLEAR.

- Domain: `whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad[.]onion`
- URL: `hxxps://www[.]ransomware[.]live/id/UHJvamVjdCBUcm9qYW4gSG9yc2VAV2hpdGVhcm1vcg`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ransomware.live - Project Trojan Horse (Whitearmor)](https://www.ransomware.live/id/UHJvamVjdCBUcm9qYW4gSG9yc2VAV2hpdGVhcm1vcg)
- [ransomware.live - Whitearmor group profile](https://www.ransomware.live/group/whitearmor)
- [WatchGuard Ransomware Tracker - WhiteArmor](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/whitearmor)
- [Breachsense - WhiteArmor ransomware group](https://www.breachsense.com/ransomware-groups/whitearmor/)
- [DeXpose - Whitearmor Ransomware Attack on J.B Hunt](https://www.dexpose.io/whitearmor-ransomware-attack-on-j-b-hunt/)
- [DeXpose - Whitearmor Targets Ryder System in Ransomware Attack](https://www.dexpose.io/whitearmor-targets-ryder-system-in-ransomware-attack/)
- [Cybernews - Hisense faces $5 million ransom demand over alleged 19GB data theft](https://cybernews.com/security/ransomware-operator-claims-hisense-demands-5-million/)
- [SOCRadar Ransomware Intelligence - Ryder / Whitearmor](https://socradar.io/free-tools/ransomware-intelligence/victims/ryder-whitearmor-489d6b23)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5190