# Vortex ransomware group claims Scripps (US healthcare) on leak site

> ransomware.live lists 'Scripps' (US) as a victim of Vortex, an emerging group the tracker flags as 'New Group'. The claim covers patient clinical records/PHI, physician credentialing files, workforce timekeeping and leave records, and emergency notification/contact data. The claim is unverified and rests on a single tracker source.

- **Published:** 2026-11-10T07:12:05Z
- **Last reviewed:** 2026-11-10T07:12:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5623
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5623.png
- **ID:** TL-2026-5623
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vortex
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (1 shown free below)

## Description

On 2026-11-10 (04:57 UTC) ransomware.live recorded a leak-site listing for the victim 'Scripps' (United States, linked by the tracker to the Healthcare sector) attributed to a group named Vortex. The tracker's estimated attack date is 2026-09-17, and the listing type is 'FULL'. The claimed (truncated) description names patient clinical records and PHI, physician credentialing files, workforce timekeeping and leave records, emergency notification and contact data, and legal-hold material. The tracker warns that, as an emerging group, the claim should be treated with caution until independently verified.

Vortex is tracked by ransomware.live as an 'Active' new group, first discovered 2026-11-10, with one known Tor leak site (zyz6phauvraxghujxmecpwzlg34gtogybb4wzcmw6pvps5m2nzvsriid.onion). The group page lists 14 victims across 2 countries (13 US, 1 Germany): Healthcare (7), Manufacturing (3), Retail & E-Commerce (1), Transportation (1), Hospitality (1). Listed victims are Scripps, Storage Mart, Air Communities, Karlstorz (DE), Andersen Construction, SimonMed, El Camino Health, SOLENIS, ARTHREX, SAMTEC, BOZZUTO, CRESA, ALEXION and PYRAMID HEALTHCARE. About 4.4 TB of data is reported across 5 of the 14 victims; the SOLENIS entry claims a 1.65 TB dump (58,249 files, 336,782,341 CRM records). The ARTHREX entry states 'MORE TIERS WILL RELEASE', and some victim entries show deadlines such as 2026-11-12. The listings are consistent with a data-theft and extortion (leak-site) model.

No CVE, initial-access vector, malware family, encryptor, tooling, C2 infrastructure or TTP has been published for Vortex, and the tracker lists no tools or ransom note. Whether files were encrypted, how access was gained, and whether the Scripps claim is genuine are all unknown. No press coverage or victim confirmation was found. Searches surfaced only the unrelated May 2021 Scripps Health ransomware incident (about 147,000 individuals affected); there is no evidence of a link between that incident and this claim. Any Scripps 2026 incident reported by low-quality aggregators could not be corroborated. The ransomware.live page does not say which Scripps entity (e.g., Scripps Health) is meant, so the victim identity is itself unconfirmed. Defenders should treat this as an unverified extortion claim: monitor, validate with the organization, and hunt for data-staging and exfiltration activity rather than act on specific technical indicators, since none exist.

## MITRE ATT&CK

- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft
- T1583 Acquire Infrastructure

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Vortex Extortion Staging — Repeated Archive Utility Runs (7-Zip/WinRAR/tar) on a Host** (`TL-2026-5623-SPL-001`)

TL-2026-5623 (Vortex ransomware group, claimed Scripps/healthcare victim): the claim is a data-theft and extortion (leak-site) model with no published tooling, so this behaviour-first search flags data staging (T1560.001, T1074.001, T1005) — three or more 7z/rar/WinRAR/tar archive-creation command lines from one host/user within an hour, as seen when bulk data is compressed before exfiltration. Telemetry source: Sysmon process creation (EventCode 1).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1560.001, T1074.001, T1005
- **Data sources:** sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
( ( (Image="*\\7z.exe" OR Image="*\\7za.exe" OR Image="*\\rar.exe" OR Image="*\\winrar.exe") CommandLine="* a *" ) OR ( Image="*\\tar.exe" CommandLine="* -c*" ) )
| bin _time span=1h
| stats count AS archive_runs values(CommandLine) AS command_lines BY _time host User Image ParentImage
| where archive_runs>=3
| sort - archive_runs
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("7z.exe", "7za.exe", "rar.exe", "winrar.exe") and ProcessCommandLine matches regex @"\s-?a\s")
    or (FileName =~ "tar.exe" and ProcessCommandLine has " -c")
| summarize ArchiveRuns = count(), CommandLines = make_set(ProcessCommandLine, 10) by DeviceName, AccountName, FileName, InitiatingProcessFileName, bin(Timestamp, 1h)
| where ArchiveRuns >= 3
| project Timestamp, DeviceName, AccountName, FileName, InitiatingProcessFileName, ArchiveRuns, CommandLines
```

### Sigma

```yaml
title: Archive Utility Staging Command Line (Vortex Data Extortion Staging)
id: 5b0c2f4e-7a31-4d1e-9c55-2e8d6a1f3b70
status: experimental
description: Detects 7-Zip, WinRAR or tar being used to create archives, a common data-staging step before exfiltration in data-extortion intrusions such as those claimed by Vortex (TL-2026-5623). Single-event rule; correlate repeated hits per host in the SIEM.
references:
  - https://www.ransomware.live/group/Vortex
author: Threadlinqs Team
date: 2026/11/10
tags:
  - attack.collection
  - attack.t1560.001
  - attack.t1074.001
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection_7z_rar:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains: ' a '
  selection_tar:
    Image|endswith: '\tar.exe'
    CommandLine|contains: ' -c'
  condition: 1 of selection_*
falsepositives:
  - Backup or packaging scripts run by administrators
  - Software build and deployment pipelines
level: medium
```

**Known false positives:**

- Administrators or backup/build jobs that legitimately compress files with 7-Zip, WinRAR or tar
- Software packaging and deployment pipelines on build servers

**Tuning notes:** Exclude known backup/build service accounts and parent processes, and raise archive_runs for busy file servers. Prioritise hosts holding PHI, HR/timekeeping or credentialing data. No Vortex-specific tooling is published, so this is behavioural and should be validated against baseline activity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vortex Collection — Mass File Access on Network Shares by a Single Account (locked: unlock with TL Creds)
- Vortex Impact Preparation — Shadow Copy and Backup Destruction Commands (locked: unlock with TL Creds)
- Vortex Exfiltration Volume — Large Outbound Transfer to a Single External Destination (locked: unlock with TL Creds)
- Vortex Data Staging — Archive Files Created in HR, Clinical and Credentialing Paths (locked: unlock with TL Creds)
- Vortex Exfiltration to Cloud File-Sharing Services from Non-Browser Processes (locked: unlock with TL Creds)
- Vortex Ransom-Note Drop — Same Note Filename Created Across Many Directories (locked: unlock with TL Creds)
- Vortex Exfiltration Tooling — rclone, MEGAcmd and SCP/SFTP Clients Executed (locked: unlock with TL Creds)
- Vortex Tor Leak-Site Exposure — Onion DNS Lookups and Tor Client Execution (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 12)

Defanged, TLP:CLEAR.

- Domain: `zyz6phauvraxghujxmecpwzlg34gtogybb4wzcmw6pvps5m2nzvsriid[.]onion`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ransomware.live victim entry: Scripps (Vortex)](https://www.ransomware.live/id/U2NyaXBwc0BWb3J0ZXg)
- [ransomware.live group page: Vortex](https://www.ransomware.live/group/Vortex)
- [ransomware.live victim entry: SOLENIS (Vortex)](https://www.ransomware.live/id/U09MRU5JU0BWb3J0ZXg)
- [ransomware.live victim entry: SimonMed (Vortex)](https://www.ransomware.live/id/U2ltb25NZWRAVm9ydGV4)
- [ransomware.live victim entry: Storage Mart (Vortex)](https://www.ransomware.live/id/U3RvcmFnZSBNYXJ0QFZvcnRleA)
- [ransomware.live victim entry: Air Communities (Vortex)](https://www.ransomware.live/id/QWlyIENvbW11bml0aWVzQFZvcnRleA)
- [Leak-site screenshot of the Scripps listing (ransomware.live)](https://images.ransomware.live/victims/352b230fdb14c741e20ae3e1a72bcfab.png)
- [Context only: 147,000+ individuals' health info stolen during Scripps ransomware attack (2021, unrelated incident)](https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/147-000-individuals-health-info-stolen-during-scripps-ransomware-attack/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5623