Skip to navigation

Threat reportRansomwareTL-2026-5350

Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services

highACTIVE

Queens Public Library (66 branches, 2.3 million residents) reported a ransomware attack on Wednesday, November 4, 2026 that disrupted on-site computers, check-out/return machines, Wi-Fi, digital media services and the mobile app. No ransomware gang had claimed the attack as of Thursday evening, and the library says it is working with law enforcement and cybersecurity experts.

Key facts for Queens Public Library ransomware

IdentifiersTL-2026-5350
Also known asQPL ransomware attack
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsQueens Public Library On-site computers, check-out/return machines, Wi-Fi, digital media services, mobile app
MalwareBlack Basta - S1070, Unidentified ransomware, inc ransom
MITRE ATT&CK techniquesT1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1486 Data Encrypted for Impact, T1489 Service Stop, T1566 Phishing, T1685 Disable or Modify Tools
MotivationFINANCIAL
Target sectorsgovernment administration, education, public libraries
Target regionsNorth America, united states of america, New York City
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for Queens Public Library ransomware

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5350 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5350 Ransomware Recovery Inhibition (Shadow Copy / Backup Deletion) Preceding Encryption

Behaviour-first hunt for the pre-encryption step common to ransomware that ends in Data Encrypted for Impact (T1486): deletion of Volume Shadow Copies, backup catalogs and boot recovery via vssadmin, wmic, diskshadow, wbadmin and bcdedit (T1490). Queens Public Library (TL-2026-5350) confirmed only file-encryption impact; no family is attributed, so this is a class-level rule that also covers the precedent library-sector families (INC Ransom, Black Basta). Fires per host/user/parent so responders can isolate the host before encryption completes.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1490, T1486
  • Data sources: sysmon, windows_process_creation
  • Severity: high
  • Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ((Image="*vssadmin.exe" CommandLine="*delete*" CommandLine="*shadows*") OR (Image="*wmic.exe" CommandLine="*shadowcopy*" CommandLine="*delete*") OR (Image="*diskshadow.exe" CommandLine="*delete*" CommandLine="*shadows*") OR (Image="*wbadmin.exe" CommandLine="*delete*" (CommandLine="*catalog*" OR CommandLine="*backup*")) OR (Image="*bcdedit.exe" (CommandLine="*recoveryenabled*no*" OR CommandLine="*bootstatuspolicy*ignoreallfailures*")))
| eval technique="T1490 recovery inhibition preceding T1486 (TL-2026-5350)"
| stats count AS events dc(CommandLine) AS distinct_cmds values(CommandLine) AS commands min(_time) AS first_seen max(_time) AS last_seen BY host User ParentImage technique
| where events>=1
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_all ("delete", "shadows"))
    or (FileName =~ "wmic.exe" and ProcessCommandLine has_all ("shadowcopy", "delete"))
    or (FileName =~ "diskshadow.exe" and ProcessCommandLine has_all ("delete", "shadows"))
    or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete" and ProcessCommandLine has_any ("catalog", "backup"))
    or (FileName =~ "bcdedit.exe" and (ProcessCommandLine has_all ("recoveryenabled", "no") or ProcessCommandLine has_all ("bootstatuspolicy", "ignoreallfailures")))
| summarize Events=count(), Commands=make_set(ProcessCommandLine, 10), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName, InitiatingProcessFileName
| order by LastSeen desc

Sigma

title: TL-2026-5350 Ransomware Recovery Inhibition via Shadow Copy and Backup Deletion
id: 7c1f3a52-9d84-4e0b-b6a7-2f5e8c14d9a1
status: experimental
description: Detects deletion of shadow copies, backup catalogs and boot recovery settings that precedes ransomware file encryption (T1490, T1486). Class-level hunt for TL-2026-5350 (Queens Public Library ransomware).
references:
  - https://therecord.media/queens-library-ransomware-causes-disruptions
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.impact
  - attack.t1490
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'shadowcopy'
      - 'delete'
  selection_diskshadow:
    Image|endswith: '\diskshadow.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete backup'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  condition: 1 of selection_*
falsepositives:
  - Backup or storage administrators pruning shadow copies during maintenance
  - Imaging and deployment tooling that resets boot configuration
level: high

Known false positives:

  • Backup or storage administrators deleting shadow copies during scheduled maintenance
  • OS imaging or deployment tooling that resets bcdedit boot recovery settings

Tuning notes: Change index=windows to the index that holds Sysmon data in your environment. Allowlist known backup-server hosts and service accounts by host/User. Keep ungated on library staff workstations, kiosks and public computers, where legitimate use is near zero. Raise to a paging alert when two or more distinct commands fire on one host within 10 minutes.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • TL-2026-5350 Defender for Endpoint: Shadow Copy and Backup Deletion Before Encryption · unlock with TL Creds
  • TL-2026-5350 Defender for Endpoint: Security Tooling Tamper and Service Stop Burst · unlock with TL Creds
  • TL-2026-5350 Phishing Foothold: Office or Mail Client Spawning Script Interpreter (T1566) · unlock with TL Creds
  • TL-2026-5350 Sigma: Ransomware Recovery Inhibition and Impact Precursors · unlock with TL Creds
  • TL-2026-5350 Sigma: Service Stop and Security Tooling Impairment Before Encryption · unlock with TL Creds
  • TL-2026-5350 Sigma: Web Server or Remote-Access Process Spawning Shell (T1190) · unlock with TL Creds
  • TL-2026-5350 Security Tooling Tamper and Backup/Database Service Stop (T1562, T1489) · unlock with TL Creds
  • TL-2026-5350 Valid Account Compromise: Failed-Logon Burst Followed by Remote Logon (T1078) · unlock with TL Creds

Indicators of compromise for Queens Public Library ransomware

As of 2026-11-06, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5350.

10 indicators of compromise · unlock with TL Creds. Compare plans

How Queens Public Library ransomware works

Queens Public Library (QPL), one of the largest public library systems in the United States, disclosed that it was hit by a ransomware attack on Wednesday, November 4, 2026. According to reporting by The Record from Recorded Future News (published 2026-11-05), the incident disrupted on-site computers, check-out and return machines, Wi-Fi access, digital media services and the QPL mobile app. QPL operates 66 branches serving roughly 2.3 million residents, holds more than 5 million books in 50 languages, and also runs learning centers in public housing complexes and several mobile libraries.

QPL stated that all locations remain open as scheduled, although certain virtual and in-person programs may be impacted, and that it is working closely with law enforcement and cybersecurity experts. NYC officials did not comment in the source article. As of Thursday evening (2026-11-05) no ransomware group had claimed responsibility, no leak-site listing was reported, and no data theft, ransom demand, initial access vector, malware family or technical indicators have been made public.

The incident follows a pattern of ransomware against public library systems: Seattle Public Library (May 2024; wireless network, staff and patron computers and the online catalog taken offline), Toronto Public Library and the British Library (2023; the British Library suffered HR data theft and Toronto needed months to recover), and Pierce County Library System in Washington (April 2025, INC ransomware, more than 340,000 people notified). Libraries are attractive because outages hit public-facing services and e-book/digital lending, which gives operators leverage.

ANALYST NOTE ON EVIDENCE: Only file-encryption ransomware impact (T1486) and the resulting service disruption are confirmed by sources. The initial-access and related technique mappings in this record are UNCONFIRMED, class-level hunting hypotheses drawn from common ransomware intrusion paths and must not be read as findings about this incident. No IOCs exist yet in public sources; the IOC list contains the victim, affected services, precedent incidents and precedent ransomware families (clearly labelled as not attributed to this incident). This record should be updated when QPL, law enforcement or a leak site provides attribution or technical details.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing

Impact

T1486 Data Encrypted for Impact; T1489 Service Stop

defense-impairment

T1685 Disable or Modify Tools

Remediation for Queens Public Library ransomware

Immediate actions

  • Library and local-government networks: isolate affected segments and preserve forensic images and logs before rebuilding
  • Reset credentials for privileged, VPN and remote-access accounts and review them for anomalous logons
  • Verify offline/immutable backups are intact and untouched before restoring
  • Engage law enforcement (FBI/CISA) and incident response; monitor ransomware leak sites for any claim

Workarounds

  • Continue manual lending and check-out procedures while automated systems are offline
  • Direct patrons to unaffected channels and publish status updates

Longer-term hardening

  • Segment patron-facing Wi-Fi, kiosks and public computers from staff and back-office networks
  • Enforce MFA on all remote access and administrative accounts
  • Deploy EDR with ransomware behavioral detection on servers and staff endpoints
  • Maintain tested offline backups and a rehearsed incident-response and manual-operations plan

Affected and fixed versions

  • Queens Public Library — On-site computers, check-out/return machines, Wi-Fi, digital media services, mobile app
    Vulnerable versions: Not disclosed

Timeline of Queens Public Library ransomware

Last updated · revalidated 1× · latest source

  • locked-ioc-4 discovers a ransomware attack that takes its wireless network, staff and patron computers and online catalog offline (announced 2024-05-28).
  • locked-ioc-2 (WA) network accessed by intruders from 2025-04-15 to 2025-04-21; later claimed by the INC ransomware gang.
  • locked-ioc-2 discovers the intrusion; 340,000+ people were ultimately impacted.
  • locked-ioc-2 confirms the intrusion; INC claims responsibility in May 2025.
  • QPL states all locations remain open as scheduled, some virtual and in-person programs may be impacted, and it is working with law enforcement and cybersecurity experts.
  • locked-ioc-6 reports a ransomware attack on Wednesday afternoon, disrupting on-site computers, check-out/return machines, Wi-Fi, digital media services and the mobile app.
  • Services remain down on Thursday across all 66 branches with no restoration timeline; CEO Dennis Walcott says the NYPD, FBI and federal partners are engaged and it is unclear whether user data was exposed.
  • As of Thursday evening no ransomware group has claimed the attack and no data theft has been reported.
  • The Record from Recorded Future News publishes the incident; NYC officials decline comment.
  • The Cyber Express publishes its report on the attack; still no actor claim, ransom demand details or confirmed data theft.

Update history

Sources cited for Queens Public Library ransomware

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats