# Vanderbilt University hit in BYOD ransomware attack, data theft claimed

> Vanderbilt University confirmed an active cybersecurity incident on 2026-11-09 that may affect university devices, systems and cloud-based services. The BYOD ransomware/extortion group, which emerged in 2026, claims it encrypted databases, fully took over the domain controller and stole over 1 million SSNs plus student, employee and research data. Vanderbilt has not confirmed encryption, data theft or BYOD attribution.

- **Published:** 2026-11-10T00:09:12Z
- **Last reviewed:** 2026-11-10T00:09:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5605
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5605.png
- **ID:** TL-2026-5605
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** BYOD
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (1 shown free below)

## Description

On 2026-11-09 Vanderbilt University said on X that it was responding to an active cybersecurity incident that may affect university devices, systems and cloud-based services. It told students, faculty and staff to shut down university devices, disconnect from university Wi-Fi and watch for warning signs: unexpected pop-ups, unusual changes to cloud files or permissions, missing or modified files, unfamiliar applications and unexpected authentication requests. Users who see these signs were told not to troubleshoot and to contact the IT service desk. Vanderbilt has not disclosed the nature of the attack and has not confirmed data theft, encryption or the involvement of any group.

The same day, the BYOD group listed Vanderbilt on its leak site. The post claims encryption of databases, 'full takeover' of the network's domain controller, and theft of 'Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers' plus student, employee and research data ('We have your entire estate and research data'). BleepingComputer received a photo of a screen showing Vanderbilt-associated icons and a ransom note named README_BYOD_31.txt. The note opens 'Oh no, you have been compromised by BYOD :<,', claims the attackers hold all data 'including your backups', says every SSN is archived along with names, emails, phone numbers, work addresses, roles and birthdays, threatens to release the data and cause further disruption unless the university negotiates, and gives SESSION messenger contact details. BleepingComputer confirmed the note links to the BYOD leak site. A YouTube video shows infected devices playing audio saying the network was compromised by 'BYOD'.

BYOD is a new group. ransomware.live lists its first victim with an estimated attack date of 2026-09-29, first discovery 2026-10-05, and 17 victims as of 2026-11-09 (US 7, UK 1, Singapore 1, Malaysia 1; education, technology, hospitality and government sectors), with about 922 GB exfiltrated across 4 victims. Its leak site is a Tor .onion DLS. Contact channels listed by ransomware.live are the email byod@onionmail.org and a SESSION ID. Other claimed victims include the University of New Mexico Health Sciences Center (attack 2026-10-26; claimed 36,000 machines, both Active Directory forests, the full Microsoft Entra tenant, two Oracle databases and Cerner EHR rosters), Michigan State University (listed 2026-11-02; 1.3M student records claimed), IHG Hotels & Resorts and Texas HHSC. In the UNM case the group later offered free decryption keys to healthcare facilities, said it would keep the stolen data and offered patients up to $2,500. It frames its activity as 'pentesting' on its FAQ page. UNM said the event affected some end-user devices but did not penetrate core systems or servers, which conflicts with the group's claims.

The initial access vector, tooling, encryption method, file extension and intrusion timeframe are not reported in any source. All BYOD claims about Vanderbilt are unverified. Defenders should treat the domain controller and Entra identity plane as the priority for hunting, since those are the assets the group claims to control.

## MITRE ATT&CK

- T1657 Financial Theft
- T1491.001 Internal Defacement
- T1078.002 Domain Accounts
- T1078.004 Cloud Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BYOD Ransomware Note README_BYOD_31.txt Dropped on Endpoint** (`TL-2026-5605-SPL-001`)

Detects creation of the BYOD ransomware/extortion note (README_BYOD_31.txt and numbered variants, opening line 'Oh no, you have been compromised by BYOD') via Sysmon FileCreate events. The note was reported on a Vanderbilt-associated screen (TL-2026-5605) and links to the BYOD Tor leak site and SESSION contact. The filename is the strongest published host IOC for this group; encryptor details are not public, so detection is anchored on the note artifact. Impact-stage detection: fires when encryption/extortion is already underway, so use it to trigger immediate isolation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1486, T1491.001, T1657
- **Data sources:** sysmon, Sysmon Event ID 11 (FileCreate), index=sysmon
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-24h TargetFilename="*README_BYOD_*.txt" | stats count AS note_count dc(TargetFilename) AS unique_note_paths values(Image) AS writing_processes min(_time) AS first_seen max(_time) AS last_seen BY host, User | convert ctime(first_seen) ctime(last_seen) | sort - note_count
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FileName startswith "README_BYOD_" and FileName endswith ".txt"
| summarize NoteCount = count(), UniquePaths = dcount(FolderPath), Writers = make_set(InitiatingProcessFileName, 10), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessAccountName
| order by NoteCount desc
```

### Sigma

```yaml
title: BYOD Ransomware Note README_BYOD_31.txt Created
id: 6f1c2a52-3b7e-4d1a-9c58-0a7e4b2d9f11
status: experimental
description: Detects creation of the BYOD ransomware note README_BYOD_<n>.txt (observed as README_BYOD_31.txt in the Vanderbilt University incident, TL-2026-5605).
references:
  - https://www.bleepingcomputer.com/news/security/vanderbilt-university-hit-in-byod-ransomware-attack-data-theft-claimed/
  - https://www.ransomware.live/group/byod
author: Threadlinqs Team
date: 2026-11-10
tags:
  - attack.impact
  - attack.t1486
  - attack.t1491.001
  - attack.t1657
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|re: '(?i)README_BYOD_\d*\.txt$'
  condition: selection
falsepositives:
  - Security researchers or IR staff copying a ransom-note sample to an analysis host
  - Threat-intel sandboxes detonating BYOD samples
level: critical
```

**Known false positives:**

- Analysts or sandboxes handling BYOD ransom-note samples
- Threat-intel tooling that stores IOC filenames on disk

**Tuning notes:** Exclude known malware-analysis hosts and IR share paths. The _31 suffix may vary per victim, so the wildcard README_BYOD_* is intentional. Pair with a high-volume file-rename search to confirm encryption. Adjust the index name to your Sysmon index.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- BYOD Ransom Note Mass Distribution Across Directories (locked: unlock with TL Creds)
- Entra ID Privileged Role or Credential Changes (Cloud Identity Takeover) (locked: unlock with TL Creds)
- Endpoint Connections to BYOD Contact Channels — [indicator], SESSION, Tor (locked: unlock with TL Creds)
- BYOD Ransom Note Written by Script Hosts or LOLBins (locked: unlock with TL Creds)
- Backup and Recovery Inhibition (Shadow Copy, Catalog, Boot Recovery) (locked: unlock with TL Creds)
- Valid Domain or Cloud Account Abuse — Anomalous Privileged Sign-in Following Enumeration (locked: unlock with TL Creds)
- Domain Controller Takeover — DCSync Replication Rights Abused by Non-DC Account (locked: unlock with TL Creds)
- BYOD Extortion Contact Infrastructure — [indicator], SESSION Messenger and .onion DNS Lookups (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 11)

Defanged, TLP:CLEAR.

- Domain: `onionmail[.]org`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Vanderbilt University hit in BYOD ransomware attack, data theft claimed (BleepingComputer)](https://www.bleepingcomputer.com/news/security/vanderbilt-university-hit-in-byod-ransomware-attack-data-theft-claimed/)
- [Vanderbilt University statement on active cybersecurity incident (X)](https://x.com/VanderbiltU/status/2119839382869864769)
- [UNM Health ransomware attack disrupts patient care, surgeries (BleepingComputer)](https://www.bleepingcomputer.com/news/security/unm-health-ransomware-attack-disrupts-patient-care-surgeries/)
- [Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack (Help Net Security)](https://helpnetsecurity.com/2026/10/27/university-of-new-mexico-hospitals-cyberattack)
- [ransomware.live BYOD group profile](https://www.ransomware.live/group/byod)
- [UNM Health ransomware attack, BYOD 36,000 systems claim (Tech Insider)](https://tech-insider.org/unm-health-ransomware-attack-byod-36000-systems-claim-2026/)
- [Michigan State University BYOD ransomware listing (SOCRadar)](https://socradar.io/data-breach/michigan-state-university-byod-ransomware-2026/)
- [Ransomware group claims theft of data tied to 1.3M Spartans as MSU investigates](https://kmph.com/news/nation-world/ransomware-group-claims-theft-of-data-tied-to-13m-spartans-as-msu-investigates)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5605