Skip to navigation

Threat reportRansomwareTL-2026-5623

Vortex ransomware group claims Scripps (US healthcare) on leak site

highACTIVE

ransomware.live lists 'Scripps' (US) as a victim of Vortex, an emerging group the tracker flags as 'New Group'. The claim covers patient clinical records/PHI, physician credentialing files, workforce timekeeping and leave records, and emergency notification/contact data. The claim is unverified and rests on a single tracker source.

Key facts

IdentifiersTL-2026-5623
SeverityHIGH
First disclosed
Affected productsScripps Organization data (patient clinical records/PHI, credentialing, workforce, emergency contact data)
AttributionVortex (low confidence)
MalwareVorteX, Vortex Ransomware
MITRE ATT&CK techniquesT1005 Data from Local System, T1567 Exfiltration Over Web Service, T1583 Acquire Infrastructure, T1657 Financial Theft
MotivationFINANCIAL
Target sectorshealth, manufacturing, retail, transport, hospitality
Target regionsNorth America, Europe
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5623 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Vortex Extortion Staging — Repeated Archive Utility Runs (7-Zip/WinRAR/tar) on a Host

TL-2026-5623 (Vortex ransomware group, claimed Scripps/healthcare victim): the claim is a data-theft and extortion (leak-site) model with no published tooling, so this behaviour-first search flags data staging (T1560.001, T1074.001, T1005) — three or more 7z/rar/WinRAR/tar archive-creation command lines from one host/user within an hour, as seen when bulk data is compressed before exfiltration. Telemetry source: Sysmon process creation (EventCode 1).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1560.001, T1074.001, T1005
  • Data sources: sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
  • Severity: medium
  • Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
( ( (Image="*\\7z.exe" OR Image="*\\7za.exe" OR Image="*\\rar.exe" OR Image="*\\winrar.exe") CommandLine="* a *" ) OR ( Image="*\\tar.exe" CommandLine="* -c*" ) )
| bin _time span=1h
| stats count AS archive_runs values(CommandLine) AS command_lines BY _time host User Image ParentImage
| where archive_runs>=3
| sort - archive_runs

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("7z.exe", "7za.exe", "rar.exe", "winrar.exe") and ProcessCommandLine matches regex @"\s-?a\s")
    or (FileName =~ "tar.exe" and ProcessCommandLine has " -c")
| summarize ArchiveRuns = count(), CommandLines = make_set(ProcessCommandLine, 10) by DeviceName, AccountName, FileName, InitiatingProcessFileName, bin(Timestamp, 1h)
| where ArchiveRuns >= 3
| project Timestamp, DeviceName, AccountName, FileName, InitiatingProcessFileName, ArchiveRuns, CommandLines

Sigma

title: Archive Utility Staging Command Line (Vortex Data Extortion Staging)
id: 5b0c2f4e-7a31-4d1e-9c55-2e8d6a1f3b70
status: experimental
description: Detects 7-Zip, WinRAR or tar being used to create archives, a common data-staging step before exfiltration in data-extortion intrusions such as those claimed by Vortex (TL-2026-5623). Single-event rule; correlate repeated hits per host in the SIEM.
references:
  - https://www.ransomware.live/group/Vortex
author: Threadlinqs Team
date: 2026/11/10
tags:
  - attack.collection
  - attack.t1560.001
  - attack.t1074.001
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection_7z_rar:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains: ' a '
  selection_tar:
    Image|endswith: '\tar.exe'
    CommandLine|contains: ' -c'
  condition: 1 of selection_*
falsepositives:
  - Backup or packaging scripts run by administrators
  - Software build and deployment pipelines
level: medium

Known false positives:

  • Administrators or backup/build jobs that legitimately compress files with 7-Zip, WinRAR or tar
  • Software packaging and deployment pipelines on build servers

Tuning notes: Exclude known backup/build service accounts and parent processes, and raise archive_runs for busy file servers. Prioritise hosts holding PHI, HR/timekeeping or credentialing data. No Vortex-specific tooling is published, so this is behavioural and should be validated against baseline activity.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Vortex Collection — Mass File Access on Network Shares by a Single Account · unlock with TL Creds
  • Vortex Impact Preparation — Shadow Copy and Backup Destruction Commands · unlock with TL Creds
  • Vortex Exfiltration Volume — Large Outbound Transfer to a Single External Destination · unlock with TL Creds
  • Vortex Data Staging — Archive Files Created in HR, Clinical and Credentialing Paths · unlock with TL Creds
  • Vortex Exfiltration to Cloud File-Sharing Services from Non-Browser Processes · unlock with TL Creds
  • Vortex Ransom-Note Drop — Same Note Filename Created Across Many Directories · unlock with TL Creds
  • Vortex Exfiltration Tooling — rclone, MEGAcmd and SCP/SFTP Clients Executed · unlock with TL Creds
  • Vortex Tor Leak-Site Exposure — Onion DNS Lookups and Tor Client Execution · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5623.

Sample indicators (1 of 12)

  • Domain: zyz6phauvraxghujxmecpwzlg34gtogybb4wzcmw6pvps5m2nzvsriid[.]onion

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

12 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

On 2026-11-10 (04:57 UTC) ransomware.live recorded a leak-site listing for the victim 'Scripps' (United States, linked by the tracker to the Healthcare sector) attributed to a group named Vortex. The tracker's estimated attack date is 2026-09-17, and the listing type is 'FULL'. The claimed (truncated) description names patient clinical records and PHI, physician credentialing files, workforce timekeeping and leave records, emergency notification and contact data, and legal-hold material. The tracker warns that, as an emerging group, the claim should be treated with caution until independently verified.

Vortex is tracked by ransomware.live as an 'Active' new group, first discovered 2026-11-10, with one known Tor leak site (zyz6phauvraxghujxmecpwzlg34gtogybb4wzcmw6pvps5m2nzvsriid.onion). The group page lists 14 victims across 2 countries (13 US, 1 Germany): Healthcare (7), Manufacturing (3), Retail & E-Commerce (1), Transportation (1), Hospitality (1). Listed victims are Scripps, Storage Mart, Air Communities, Karlstorz (DE), Andersen Construction, SimonMed, El Camino Health, SOLENIS, ARTHREX, SAMTEC, BOZZUTO, CRESA, ALEXION and PYRAMID HEALTHCARE. About 4.4 TB of data is reported across 5 of the 14 victims; the SOLENIS entry claims a 1.65 TB dump (58,249 files, 336,782,341 CRM records). The ARTHREX entry states 'MORE TIERS WILL RELEASE', and some victim entries show deadlines such as 2026-11-12. The listings are consistent with a data-theft and extortion (leak-site) model.

No CVE, initial-access vector, malware family, encryptor, tooling, C2 infrastructure or TTP has been published for Vortex, and the tracker lists no tools or ransom note. Whether files were encrypted, how access was gained, and whether the Scripps claim is genuine are all unknown. No press coverage or victim confirmation was found. Searches surfaced only the unrelated May 2021 Scripps Health ransomware incident (about 147,000 individuals affected); there is no evidence of a link between that incident and this claim. Any Scripps 2026 incident reported by low-quality aggregators could not be corroborated. The ransomware.live page does not say which Scripps entity (e.g., Scripps Health) is meant, so the victim identity is itself unconfirmed. Defenders should treat this as an unverified extortion claim: monitor, validate with the organization, and hunt for data-staging and exfiltration activity rather than act on specific technical indicators, since none exist.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583 Acquire Infrastructure

Impact

T1657 Financial Theft

Remediation

Immediate actions

  • Healthcare organizations: verify with Scripps or the affected entity whether the claim is genuine before acting; treat as unverified until confirmed
  • Monitor the ransomware.live Vortex group page for further tiered releases and for victim updates
  • Review egress logs for large outbound transfers to unfamiliar hosts or file-sharing services dating from mid-September 2026 onward
  • Check data-staging locations (large archives, compression activity) on file servers, HR/timekeeping systems and credentialing repositories

Workarounds

  • No CVE or specific vulnerability has been published for this group; no patch applies
  • If the claim is confirmed, follow HIPAA breach-notification obligations and engage legal counsel

Longer-term hardening

  • Maintain tested offline backups and an incident-response plan covering double-extortion scenarios
  • Apply data-loss-prevention and egress monitoring on systems holding PHI
  • Enforce MFA and least privilege on remote access and administrative accounts

Affected and fixed versions

  • Scripps — Organization data (patient clinical records/PHI, credentialing, workforce, emergency contact data)

Timeline

  • Context only, not linked to this claim: earlier Scripps Health ransomware incident (data exfiltrated April 21, 2021; about 147,000 individuals later notified)
  • ransomware.live's estimated attack date for the Scripps claim; the same date is given for Storage Mart and Air Communities
  • Estimated attack date for another Vortex victim, SimonMed
  • Estimated attack date for Vortex victim SOLENIS (1.65 TB claimed)
  • ransomware.live discovered the Scripps listing at 04:57 UTC and the Vortex group the same day; 14 victims are listed, with 5 more same-day Vortex victims including Storage Mart, Air Communities, Karlstorz, Andersen Construction and SimonMed
  • Deadline displayed on some Vortex victim entries per ransomware.live (the Scripps entry's own deadline was not shown)

Sources cited

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats