Maersk confirms data breach of legacy OCF/LF Logistics system as WhiteArmor ransomware demands $5 million

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5781 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WhiteArmor Contact Channels - Web Proxy Access to Leak Site, Telegram and X Accounts

Detects web-proxy requests to WhiteArmor infrastructure: the clearnet site whitearmor.cc, the Tor leak site whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion, the Telegram channel t.me/whitearmorxd and the X account WhiteArmorxd. Indicates operator contact, negotiation or leak-site browsing (T1657, T1102, T1090.003, T1071.001).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1657, T1102, T1090.003, T1071.001
• Data sources: proxy
• Severity: high
• Confidence: high

Splunk SPL

index=proxy sourcetype IN ("pan:traffic","zscaler:nss-web","bluecoat:proxysg:access:syslog","squid:access") earliest=-24h
| eval target=lower(coalesce(url, uri, url_domain, dest_host))
| where match(target,"(^|[./@])whitearmor\.cc") OR match(target,"whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad") OR match(target,"(t\.me|x\.com|twitter\.com)/whitearmorxd") OR match(target,"\.onion(:[0-9]+)?(/|$)")
| stats count min(_time) as first_seen max(_time) as last_seen values(target) as urls by src_ip, user
| sort - count

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend Target = tolower(coalesce(RequestURL, DestinationHostName))
| where Target has_any ("whitearmor.cc", "whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad", "t.me/whitearmorxd", "x.com/whitearmorxd", "twitter.com/whitearmorxd") or Target matches regex @"\.onion(:[0-9]+)?(/|$)"
| project TimeGenerated, SourceIP, SourceUserName, DestinationIP, Target, DeviceVendor

Sigma

title: Access to WhiteArmor Leak Site and Contact Channels
id: 5f0c2a41-7b1e-5d3a-9c64-2e8a1b7d0a03
status: experimental
description: Detects proxy requests to whitearmor.cc, the WhiteArmor Tor leak site, or the WhiteArmor Telegram and X accounts (TL-2026-5781).
references:
    - https://www.bleepingcomputer.com/news/security/maersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million/
    - https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/whitearmor
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.command-and-control
    - attack.t1102
    - attack.t1090.003
    - attack.t1071.001
    - attack.impact
    - attack.t1657
logsource:
    category: proxy
detection:
    selection_domain:
        cs-host|endswith:
            - 'whitearmor.cc'
            - 'whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion'
    selection_social:
        c-uri|contains:
            - 't.me/whitearmorxd'
            - 'x.com/WhiteArmorxd'
    condition: 1 of selection_*
falsepositives:
    - Threat-intelligence analysts browsing the leak site from a research network
    - Security awareness material referencing the group
level: high

Known false positives:

• Threat-intel or incident-response staff intentionally visiting WhiteArmor infrastructure
• Security awareness mail or sandbox detonation of linked URLs

Tuning notes: Exclude analyst research subnets. Any hit from a production server or logistics platform host should be treated as high priority.

• 🔒 Privileged Account Creation and Admin Group Membership Bursts on Legacy Platform Hosts · unlock with TL Creds
• 🔒 Data Staging - Password-Protected Archive of Database, Inventory or Driver Exports · unlock with TL Creds
• 🔒 Tor Client or Onion Connection from Servers - WhiteArmor Leak Site Infrastructure · unlock with TL Creds
• 🔒 Ransomware Precursor - Backup, Shadow Copy and Recovery Inhibition · unlock with TL Creds
• 🔒 Exfiltration Tooling - Rclone, MEGAcmd, WinSCP, AzCopy and Curl Uploads · unlock with TL Creds
• 🔒 DNS Resolution of WhiteArmor Leak Site and Onion Domains · unlock with TL Creds
• 🔒 WhiteArmor Data Theft - Bulk Upload to File-Sharing Services or WhiteArmor Infrastructure · unlock with TL Creds
• 🔒 WhiteArmor Credential Harvesting - Plaintext Password Search in Configuration and Data Files · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5781.

Sample indicators (1 of 11)

• Domain: whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad[.]onion

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

Technical analysis

On 2026-11-11 BleepingComputer reported that WhiteArmor, an emerging ransomware/extortion group first seen in October 2026, listed A.P. Moller-Maersk on its leak site over the weekend before publication (Breachsense records the Maersk listing on 2026-11-09). The group demands USD 5,000,000 in bitcoin and gives 30 days to make contact and pay. It claims roughly 100 GB of data taken from Maersk's OCF/LF Logistics platform.

Claimed data includes nearly 30,000 driver records, plaintext passwords, 33 SUPER_ADMIN accounts, signed delivery receipts, inventory rows with purchase orders and Advance Shipping Notices (the article quotes the figure as '14.44 inventory rows', possibly a typo), and 27,842 mobile device logs containing phone numbers, emails and IMEI numbers. The group framed the demand against the former LF Logistics arm, saying $5M is 'roughly four hours of that EBITDA'. All claims are unverified.

Maersk confirmed that a threat actor breached systems of a company it previously acquired and stole data. The platform traces to LF Logistics, which Maersk acquired from the Li & Fung Group in 2022 and which originally developed the OCF/LF Logistics platform. Maersk states the incident is 'isolated to a local system', that no sensitive data has been disclosed according to current evidence, that it does not expect operational disruption, and that other Maersk systems and customer/partner API and EDI connections are unaffected. Maersk did not disclose the affected system, data types or intrusion date, and the investigation is ongoing. There is a discrepancy between Maersk's statement and the actor's claim of plaintext passwords and privileged accounts.

No initial access vector, tooling, CVE, malware or IOCs have been published. Sourced activity is limited to compromise of a legacy system, data theft and leak-site extortion. WatchGuard classes WhiteArmor as crypto-ransomware using direct, double and free-leak extortion, but no encryption was reported at Maersk. Per Breachsense, WhiteArmor has named 15 victims since 2026-10-22, with logistics the most frequent sector (Maersk, Echo Global Logistics, Ryder System, J.B. Hunt Transport Services). Other listed victims include Whirlpool, Hisense, Unilever, KuCoin and Lovesac. WatchGuard lists demands from $140,000 to $20,000,000.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Credential Access

T1552 Unsecured Credentials

Exfiltration

T1567 Exfiltration Over Web Service

Impact

T1657 Financial Theft

Remediation

Immediate actions

• Inventory and review legacy or acquired-company platforms (such as OCF/LF Logistics) for exposure and isolate them from core networks
• Reset credentials and rotate secrets on affected legacy platforms, and audit privileged (SUPER_ADMIN) accounts
• Block the WhiteArmor clearnet domain and monitor for WhiteArmor-related contact channels and mentions of your organization on its leak site
• Hunt for large outbound data transfers from legacy logistics and warehouse-management systems

Workarounds

• Restrict API and EDI links between legacy platforms and partner systems until the platform is verified clean

Longer-term hardening

• Store no plaintext passwords; enforce hashing, MFA and least privilege on admin accounts
• Complete security integration of acquired businesses, and decommission or segment legacy systems
• Maintain tested offline backups and an extortion-response playbook covering data-theft-only incidents
• Review notification obligations for driver, device and customer data (phone numbers, emails, IMEI)

Affected and fixed versions

• A.P. Moller-Maersk — OCF/LF Logistics platform (legacy system of acquired LF Logistics)
  Vulnerable versions: Unspecified

Timeline

• 2022-01-01 Maersk acquires LF Logistics from the Li & Fung Group in 2022 (exact date not stated); LF Logistics was the original developer of the OCF/LF Logistics platform.
• 2026-10-20 WhiteArmor posts its first victims on its leak site (WatchGuard records victims from 2026-10-20; Breachsense records Whirlpool on 2026-10-22). WatchGuard lists its first-seen date as October 2026.
• 2026-10-28 WhiteArmor posts several logistics victims (including Echo Global Logistics and Ryder System), with demands of up to $20M listed by WatchGuard.
• 2026-11-09 WhiteArmor lists Maersk on its leak site (Breachsense records the claim on 2026-11-09).
• 2026-11-11 BleepingComputer reports the $5M bitcoin demand, the 30-day deadline and the ~100 GB claim, and notes that the claims are unverified.
• 2026-11-11 Maersk confirms that a threat actor breached a legacy system of a previously acquired company and stole data, and publishes a statement saying the incident is isolated.

Sources cited

• Maersk statement: IT security incident maersk.com · Vendor report · 2026-11-11
• WatchGuard Ransomware Tracker: WhiteArmor watchguard.com · Research · 2026-10-28
• Breachsense: WhiteArmor ransomware group breachsense.com · Research · 2026-11-11
• Breachsense: Maersk data breach claim breachsense.com · Research · 2026-11-09
• Maersk confirms data breach as WhiteArmor ransomware demands $5 million BleepingComputer · News · 2026-11-11
• BleepingComputer: Maersk Reinstalled 45,000 PCs and 4,000 Servers to Recover From NotPetya Attack BleepingComputer · News · 2018-01-25

More in ransomware

• Qilin Ransomware-as-a-Service Group: Leadership Attribution (Haise / Rjun / Alexbigboss44) and Most Active Affiliate Program
• Citrus Ransomware: VLESS tunnels, Sn00py encryption and LLM-assisted scripting (CVE-2026-54121, CVE-2020-1337)
• MedusaLocker ransomware leak-site listing: victim 'Capetown' (identity unverified)
• Sophos State of Ransomware in Retail 2026: Exploited Vulnerabilities Lead Retail Root Causes, Encryption Rate Rises to 62%
• Bitdefender Threat Debrief Nov 2026: AI-assisted ransomware actors N0n and Azazel (MCP reverse-shell C2), BYOD, Booba Team

More from WhiteArmor

• Whitearmor (emerging ransomware group) 'Project Trojan Horse' - initial access sales and insider recruitment
• WhiteArmor ransomware/extortion group claims Hisense data theft (19 GB) and demands $5 million in Bitcoin
• Wagyu.xyz Alleged Data Leak: 38,628 Swap Orders and 10,139 IPs Claimed by WhiteArmor, Exposing Monero Metadata Correlation Risk
• WhiteArmor: New Data-Theft Extortion Group Claiming JWT Authentication Bypass Exploitation and Developing Ransomware