Skip to navigation

Threat reportRansomwareTL-2026-5605

Vanderbilt University hit in BYOD ransomware attack, data theft claimed

highACTIVE

Vanderbilt University confirmed an active cybersecurity incident on 2026-11-09 that may affect university devices, systems and cloud-based services. The BYOD ransomware/extortion group, which emerged in 2026, claims it encrypted databases, fully took over the domain controller and stole over 1 million SSNs plus student, employee and research data. First disclosed .

Key facts

IdentifiersTL-2026-5605
Also known asBYOD ransomware
SeverityHIGH
First disclosed
Affected productsVanderbilt University University devices, systems and cloud-based services (organization-level incident)
AttributionBYOD (medium confidence)
MalwareBYOD
MITRE ATT&CK techniquesT1078.002 Domain Accounts, T1078.004 Cloud Accounts, T1491.001 Internal Defacement, T1657 Financial Theft
MotivationFINANCIAL
Target sectorseducation, health, technology, hospitality, government administration
Target regionsNorth America, Europe, Asia
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5605 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: BYOD Ransomware Note README_BYOD_31.txt Dropped on Endpoint

Detects creation of the BYOD ransomware/extortion note (README_BYOD_31.txt and numbered variants, opening line 'Oh no, you have been compromised by BYOD') via Sysmon FileCreate events. The note was reported on a Vanderbilt-associated screen (TL-2026-5605) and links to the BYOD Tor leak site and SESSION contact. The filename is the strongest published host IOC for this group; encryptor details are not public, so detection is anchored on the note artifact. Impact-stage detection: fires when encryption/extortion is already underway, so use it to trigger immediate isolation.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1486, T1491.001, T1657
  • Data sources: sysmon, Sysmon Event ID 11 (FileCreate), index=sysmon
  • Severity: critical
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-24h TargetFilename="*README_BYOD_*.txt" | stats count AS note_count dc(TargetFilename) AS unique_note_paths values(Image) AS writing_processes min(_time) AS first_seen max(_time) AS last_seen BY host, User | convert ctime(first_seen) ctime(last_seen) | sort - note_count

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FileName startswith "README_BYOD_" and FileName endswith ".txt"
| summarize NoteCount = count(), UniquePaths = dcount(FolderPath), Writers = make_set(InitiatingProcessFileName, 10), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessAccountName
| order by NoteCount desc

Sigma

title: BYOD Ransomware Note README_BYOD_31.txt Created
id: 6f1c2a52-3b7e-4d1a-9c58-0a7e4b2d9f11
status: experimental
description: Detects creation of the BYOD ransomware note README_BYOD_<n>.txt (observed as README_BYOD_31.txt in the Vanderbilt University incident, TL-2026-5605).
references:
  - https://www.bleepingcomputer.com/news/security/vanderbilt-university-hit-in-byod-ransomware-attack-data-theft-claimed/
  - https://www.ransomware.live/group/byod
author: Threadlinqs Team
date: 2026-11-10
tags:
  - attack.impact
  - attack.t1486
  - attack.t1491.001
  - attack.t1657
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|re: '(?i)README_BYOD_\d*\.txt$'
  condition: selection
falsepositives:
  - Security researchers or IR staff copying a ransom-note sample to an analysis host
  - Threat-intel sandboxes detonating BYOD samples
level: critical

Known false positives:

  • Analysts or sandboxes handling BYOD ransom-note samples
  • Threat-intel tooling that stores IOC filenames on disk

Tuning notes: Exclude known malware-analysis hosts and IR share paths. The _31 suffix may vary per victim, so the wildcard README_BYOD_* is intentional. Pair with a high-volume file-rename search to confirm encryption. Adjust the index name to your Sysmon index.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • BYOD Ransom Note Mass Distribution Across Directories · unlock with TL Creds
  • Entra ID Privileged Role or Credential Changes (Cloud Identity Takeover) · unlock with TL Creds
  • Endpoint Connections to BYOD Contact Channels — [indicator], SESSION, Tor · unlock with TL Creds
  • BYOD Ransom Note Written by Script Hosts or LOLBins · unlock with TL Creds
  • Backup and Recovery Inhibition (Shadow Copy, Catalog, Boot Recovery) · unlock with TL Creds
  • Valid Domain or Cloud Account Abuse — Anomalous Privileged Sign-in Following Enumeration · unlock with TL Creds
  • Domain Controller Takeover — DCSync Replication Rights Abused by Non-DC Account · unlock with TL Creds
  • BYOD Extortion Contact Infrastructure — [indicator], SESSION Messenger and .onion DNS Lookups · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5605.

Sample indicators (1 of 11)

  • Domain: onionmail[.]org

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

11 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

Vanderbilt has not confirmed encryption, data theft or BYOD attribution.

On 2026-11-09 Vanderbilt University said on X that it was responding to an active cybersecurity incident that may affect university devices, systems and cloud-based services. It told students, faculty and staff to shut down university devices, disconnect from university Wi-Fi and watch for warning signs: unexpected pop-ups, unusual changes to cloud files or permissions, missing or modified files, unfamiliar applications and unexpected authentication requests. Users who see these signs were told not to troubleshoot and to contact the IT service desk. Vanderbilt has not disclosed the nature of the attack and has not confirmed data theft, encryption or the involvement of any group.

The same day, the BYOD group listed Vanderbilt on its leak site. The post claims encryption of databases, 'full takeover' of the network's domain controller, and theft of 'Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers' plus student, employee and research data ('We have your entire estate and research data'). BleepingComputer received a photo of a screen showing Vanderbilt-associated icons and a ransom note named README_BYOD_31.txt. The note opens 'Oh no, you have been compromised by BYOD :<,', claims the attackers hold all data 'including your backups', says every SSN is archived along with names, emails, phone numbers, work addresses, roles and birthdays, threatens to release the data and cause further disruption unless the university negotiates, and gives SESSION messenger contact details. BleepingComputer confirmed the note links to the BYOD leak site. A YouTube video shows infected devices playing audio saying the network was compromised by 'BYOD'.

BYOD is a new group. ransomware.live lists its first victim with an estimated attack date of 2026-09-29, first discovery 2026-10-05, and 17 victims as of 2026-11-09 (US 7, UK 1, Singapore 1, Malaysia 1; education, technology, hospitality and government sectors), with about 922 GB exfiltrated across 4 victims. Its leak site is a Tor .onion DLS. Contact channels listed by ransomware.live are the email byod@onionmail.org and a SESSION ID. Other claimed victims include the University of New Mexico Health Sciences Center (attack 2026-10-26; claimed 36,000 machines, both Active Directory forests, the full Microsoft Entra tenant, two Oracle databases and Cerner EHR rosters), Michigan State University (listed 2026-11-02; 1.3M student records claimed), IHG Hotels & Resorts and Texas HHSC. In the UNM case the group later offered free decryption keys to healthcare facilities, said it would keep the stolen data and offered patients up to $2,500. It frames its activity as 'pentesting' on its FAQ page. UNM said the event affected some end-user devices but did not penetrate core systems or servers, which conflicts with the group's claims.

The initial access vector, tooling, encryption method, file extension and intrusion timeframe are not reported in any source. All BYOD claims about Vanderbilt are unverified. Defenders should treat the domain controller and Entra identity plane as the priority for hunting, since those are the assets the group claims to control.

MITRE ATT&CK techniques by tactic:

Privilege Escalation

T1078.002 Domain Accounts

Persistence

T1078.004 Cloud Accounts

Impact

T1491.001 Internal Defacement; T1657 Financial Theft

Remediation

Immediate actions

  • Hunt for README_BYOD_31.txt ransom notes on endpoints and file shares
  • Review domain controller and Entra ID sign-in and audit logs for unexpected privileged authentication, new accounts and permission changes
  • Reset credentials for privileged domain and cloud accounts if compromise is suspected, including KRBTGT where domain takeover is suspected
  • Isolate suspected endpoints; Vanderbilt advised shutting down devices and disconnecting from Wi-Fi
  • Block outbound SESSION messenger traffic and onionmail.org where not business-required

Workarounds

  • Do not engage with or pay actors without incident response and legal guidance
  • Warn staff and students about phishing and scams that follow a publicized breach

Longer-term hardening

  • Keep offline or immutable backups and test restores, since the note claims backups were accessed
  • Enforce MFA and conditional access on Entra and administrative accounts
  • Tier administrative accounts to limit domain controller exposure
  • Monitor for mass file modification and bulk data egress

Affected and fixed versions

  • Vanderbilt University — University devices, systems and cloud-based services (organization-level incident)

Timeline

  • ransomware.live lists the estimated attack date of BYOD's earliest tracked victims as 2026-09-29.
  • BYOD leak site first observed by ransomware.live with several victims posted.
  • University of New Mexico Health Sciences Center detects an attack around 11 a.m. MDT; ambulances are diverted and outpatient surgeries and clinics are cancelled. BYOD lists UNM on its leak site.
  • BYOD says it will provide free decryption keys to healthcare facilities, keep the stolen data and pay patients up to $2,500; UNM says it made no concessions.
  • BYOD lists Michigan State University on its leak site, claiming data on 1.3 million students (unconfirmed by MSU).
  • BYOD lists Vanderbilt on its leak site, claiming encrypted databases, full domain controller takeover and theft of over 1 million SSNs; BleepingComputer reviews a locked-ioc-1 ransom note photo.
  • Vanderbilt University announces an active cybersecurity incident and tells users to shut down devices and disconnect from Wi-Fi.

Sources cited

More from BYOD

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats