# Vexy Ransomware claims Albion Online Data Project (16 GB exfiltrated)

> The Vexy Ransomware group has listed Albion Online Data Project (www.albion-online-data.com), a US-based community market-data platform for the MMORPG Albion Online, as a victim, with 16 GB of data reportedly exfiltrated. The estimated attack date is 2026-11-07 and the claim is unverified; no leak links, TTPs or IOCs specific to this incident have been published.

- **Published:** 2026-11-09T19:17:48Z
- **Last reviewed:** 2026-11-09T19:17:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5578
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5578.png
- **ID:** TL-2026-5578
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 (1 shown free below) · **IOCs:** 10 (2 shown free below)

## Description

Ransomware.live recorded a Vexy Ransomware leak-site claim against Albion Online Data Project (www.albion-online-data.com) on 2026-11-09 at 19:08 UTC, with an estimated attack date of 2026-11-07. The victim is a US-based technology-sector community platform that publishes real-time and historical market prices and orders for the MMORPG Albion Online, and also provides APIs, data feeds and client software. The tracker reports 16 GB of data exfiltrated. No leak or download links were listed at the time of discovery. This is a group claim from a single tracker page and has not been confirmed by the victim or independently verified. The platform is a community project and is not the game publisher; the 2020 Albion Online forum breach is an unrelated historical incident.

The ransomware.live exposure report (ParanoidLab) for the victim domain shows 0 exposed passwords and 3 cookies from infostealer data, none critical. WHOIS shows privacy-protected registration with a Namecheap abuse contact; no MX, TXT or SaaS records were found.

Vexy Ransomware is a 2026 double-extortion operation. Ransomware.live lists 26 victims across 15 countries (India 6, United States 3, Brazil 3, Viet Nam 2, Bulgaria 1), mostly Technology (9), Retail & E-Commerce (5) and Manufacturing (3), with about 990 GB reported exfiltrated across 25 victims. The earliest estimated attack date is 2026-07-06 and the earliest discovery is 2026-09-03. The group runs a Tor leak blog (Apache 2.4.68 on Debian) with an average 17-day delay between attack and listing. Other recent victims include Living Word Schools (2026-11-09), ZipAI (2026-11-05), System Soft (2026-10-31), JHAMF Group (2026-10-31), polisee Inc (2026-10-17) and Data-Core Systems (2026-10-16). Ransomware.live also publishes a Tox ID and two Bitcoin wallets for the group.

Initial access for this victim is unknown. SOCRadar reports that Vexy operators reportedly buy credentials from underground markets, often harvested by infostealers. Security Arsenal (medium confidence, based on leak-site monitoring) assesses likely edge-appliance or RDP exploitation, credential stuffing and phishing, followed by lateral movement via RDP/WMI/PsExec, staging with archive tools, exfiltration, and encryption with shadow-copy deletion. Those behaviours are assessed from comparable groups and are NOT confirmed as Vexy-specific; Security Arsenal's candidate CVEs are likewise unconfirmed and are not listed on this record. Ransom note, file extension and encryption algorithm are not publicly documented. Whether the victim's systems were encrypted is not stated; the claim only reports data theft.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1569.002 System Services: Service Execution
- T1047 Windows Management Instrumentation
- T1021 Remote Services
- T1560.001 Archive Collected Data: Archive via Utility
- T1567 Exfiltration Over Web Service
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Vexy Ransomware - Pre-Encryption Recovery Inhibition and Data Staging (T1490, T1486, T1560.001, T1074) [Splunk]** (`TL-2026-5578-SPL-003`)

Detects the pre-encryption and staging behaviours listed as research IOCs for TL-2026-5578: vssadmin delete shadows /all /quiet, wmic shadowcopy delete, diskshadow.exe, bcdedit recovery disabling, wbadmin backup deletion, password-protected 7z/rar archiving, and robocopy /MIR staging. These behaviours are assessed from comparable ransomware groups (Security Arsenal) and are NOT confirmed as Vexy-specific; Vexy is a double-extortion group that exfiltrated 16 GB from the claimed victim, so staging and recovery inhibition are strong precursors to exfiltration and encryption.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1490, T1486, T1560.001, T1074
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational (EventCode 1)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval img=lower(Image), cmd=lower(CommandLine)
```comment: recovery inhibition T1490 and archive or copy staging T1560.001 and T1074```
| eval behaviour=case(match(img,"vssadmin\.exe$") AND like(cmd,"%delete%") AND like(cmd,"%shadows%"), "vssadmin delete shadows T1490", match(img,"wmic\.exe$") AND like(cmd,"%shadowcopy%") AND like(cmd,"%delete%"), "wmic shadowcopy delete T1490", match(img,"diskshadow\.exe$"), "diskshadow execution T1490", match(img,"bcdedit\.exe$") AND (like(cmd,"%recoveryenabled%no%") OR like(cmd,"%ignoreallfailures%")), "bcdedit recovery disabled T1490", match(img,"wbadmin\.exe$") AND (like(cmd,"%delete catalog%") OR like(cmd,"%delete backup%") OR like(cmd,"%delete systemstatebackup%")), "wbadmin backup deletion T1490", match(img,"(7z|7za|rar|winrar)\.exe$") AND like(cmd,"% a %") AND (like(cmd,"% -hp%") OR like(cmd,"% -p%")), "password-protected archive staging T1560.001", match(img,"robocopy\.exe$") AND like(cmd,"%/mir%"), "robocopy /MIR staging T1074")
| where isnotnull(behaviour)
| stats count, min(_time) AS first_seen, max(_time) AS last_seen, values(CommandLine) AS commands, values(ParentImage) AS parents BY host, User, behaviour
| convert ctime(first_seen) ctime(last_seen)
| eval threat_id="TL-2026-5578", technique="T1490,T1486,T1560.001,T1074"
| table host User behaviour count commands parents first_seen last_seen threat_id technique
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| extend Img = tolower(FileName), Cmd = tolower(ProcessCommandLine)
| extend Behaviour = case(
    Img == "vssadmin.exe" and Cmd contains "delete" and Cmd contains "shadows", "vssadmin delete shadows T1490",
    Img == "wmic.exe" and Cmd contains "shadowcopy" and Cmd contains "delete", "wmic shadowcopy delete T1490",
    Img == "diskshadow.exe", "diskshadow execution T1490",
    Img == "bcdedit.exe" and (Cmd contains "recoveryenabled" and Cmd contains " no" or Cmd contains "ignoreallfailures"), "bcdedit recovery disabled T1490",
    Img == "wbadmin.exe" and (Cmd contains "delete catalog" or Cmd contains "delete backup" or Cmd contains "delete systemstatebackup"), "wbadmin backup deletion T1490",
    Img in ("7z.exe", "7za.exe", "rar.exe", "winrar.exe") and Cmd contains " a " and (Cmd contains " -hp" or Cmd contains " -p"), "password-protected archive staging T1560.001",
    Img == "robocopy.exe" and Cmd contains "/mir", "robocopy /MIR staging T1074",
    "")
| where Behaviour != ""
| project Timestamp, DeviceName, AccountName, Behaviour, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
```

### Sigma

```yaml
title: Vexy Ransomware - Pre-Encryption Recovery Inhibition and Data Staging (T1490, T1560.001, T1074)
id: 2a9f5c61-b3d8-4e70-a4c2-7e1f9d086b35
status: experimental
description: Detects shadow copy deletion (vssadmin, wmic, diskshadow), bcdedit and wbadmin recovery inhibition, password-protected archiving and robocopy /MIR staging commonly seen before ransomware encryption and double-extortion exfiltration. Assessed from comparable groups and not confirmed as Vexy-specific for TL-2026-5578.
references:
    - https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules
    - https://www.ransomware.live/group/Vexy%20Ransomware
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.impact
    - attack.t1490
    - attack.t1486
    - attack.collection
    - attack.t1560.001
    - attack.t1074
logsource:
    category: process_creation
    product: windows
detection:
    selection_recovery_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_recovery_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_recovery_diskshadow:
        Image|endswith: '\diskshadow.exe'
    selection_recovery_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    selection_recovery_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains:
            - 'delete catalog'
            - 'delete backup'
            - 'delete systemstatebackup'
    selection_archive:
        Image|endswith:
            - '\7z.exe'
            - '\7za.exe'
            - '\rar.exe'
            - '\winrar.exe'
        CommandLine|contains: ' a '
    selection_archive_password:
        CommandLine|contains:
            - ' -hp'
            - ' -p'
    selection_robocopy:
        Image|endswith: '\robocopy.exe'
        CommandLine|contains: '/mir'
    condition: 1 of selection_recovery_* or (selection_archive and selection_archive_password) or selection_robocopy
falsepositives:
    - Backup and disaster-recovery software that manages shadow copies
    - Administrators performing legitimate archiving or robocopy mirroring
level: critical
```

**Known false positives:**

- Backup, imaging and disaster-recovery software that manages or deletes shadow copies
- Administrators performing legitimate password-protected archiving or robocopy /MIR mirroring
- Software installers that run bcdedit or diskshadow during maintenance

**Tuning notes:** Adjust index/sourcetype to your Sysmon onboarding. Treat the T1490 branches as high-fidelity and page on them; the archive and robocopy branches are hunting-grade, so allow-list approved backup servers, service accounts and scheduled jobs. Add a size or file-count threshold from file-creation telemetry to match ~16 GB staging volumes.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vexy Ransomware - External RDP Logon After Failure Burst (Valid Accounts T1078) [Sentinel] (locked: unlock with TL Creds)
- Vexy Ransomware - PsExec and WMI Remote Execution for Lateral Movement (T1569.002, T1047) [Sentinel] (locked: unlock with TL Creds)
- Vexy Ransomware - Pre-Encryption Recovery Inhibition and Data Staging (T1490, T1486, T1560.001, T1074) [Sentinel] (locked: unlock with TL Creds)
- Vexy Ransomware - External RDP Logon With Valid Account (T1078) [Sigma] (locked: unlock with TL Creds)
- Vexy Ransomware - PsExec and WMI Remote Execution (T1569.002, T1047) [Sigma] (locked: unlock with TL Creds)
- Vexy Ransomware - Pre-Encryption Recovery Inhibition and Data Staging (T1490, T1486, T1560.001, T1074) [Sigma] (locked: unlock with TL Creds)
- Vexy Ransomware - External RDP Logon After Failure Burst (Valid Accounts T1078) [Splunk] (locked: unlock with TL Creds)
- Vexy Ransomware - PsExec and WMI Remote Execution for Lateral Movement (T1569.002, T1047) [Splunk] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 10)

Defanged, TLP:CLEAR.

- Domain: `albion-online-data[.]com`
- URL: `hxxps://www[.]ransomware[.]live/id/QWxiaW9uIE9ubGluZSBEYXRhIFByb2plY3RAVmV4eSBSYW5zb213YXJl`

Full set of 10 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Ransomware.live victim entry: Albion Online Data Project (Vexy Ransomware)](https://www.ransomware.live/id/QWxiaW9uIE9ubGluZSBEYXRhIFByb2plY3RAVmV4eSBSYW5zb213YXJl)
- [Ransomware.live group profile: Vexy Ransomware](https://www.ransomware.live/group/Vexy%20Ransomware)
- [Security Arsenal: Vexy Ransomware Gang - 5 New Victims in 4 Days](https://securityarsenal.com/blog/vexy-ransomware-gang-5-new-victims-in-4-days-india-and-latam-campaign-sector-analysis-and-detection-rules)
- [SOCRadar: Vexy Ransomware claims Guarufilme](https://socradar.io/data-breach/vexy-ransomware-claims-guarufilme-october-13-2026/)
- [Dexpose: Vexy Ransomware Strikes Data-Core Systems](https://www.dexpose.io/vexy-ransomware-strikes-data-core-systems/)
- [Dexpose: Vexy Ransomware Strikes Sancity Soft Touch](https://www.dexpose.io/vexy-ransomware-strikes-sancity-soft-touch/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5578