# Maersk confirms data breach of legacy OCF/LF Logistics system as WhiteArmor ransomware demands $5 million

> The WhiteArmor ransomware group listed A.P. Moller-Maersk on its data leak site, demanding $5M in bitcoin within 30 days and claiming about 100 GB stolen from the OCF/LF Logistics platform. Maersk confirmed a threat actor breached a legacy system of a previously acquired company and stole data, and says the incident is isolated with no operational disruption expected.

- **Published:** 2026-11-11T16:33:26Z
- **Last reviewed:** 2026-11-11T16:33:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5781
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5781.png
- **ID:** TL-2026-5781
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** WhiteArmor
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (1 shown free below)

## Description

On 2026-11-11 BleepingComputer reported that WhiteArmor, an emerging ransomware/extortion group first seen in October 2026, listed A.P. Moller-Maersk on its leak site over the weekend before publication (Breachsense records the Maersk listing on 2026-11-09). The group demands USD 5,000,000 in bitcoin and gives 30 days to make contact and pay. It claims roughly 100 GB of data taken from Maersk's OCF/LF Logistics platform.

Claimed data includes nearly 30,000 driver records, plaintext passwords, 33 SUPER_ADMIN accounts, signed delivery receipts, inventory rows with purchase orders and Advance Shipping Notices (the article quotes the figure as '14.44 inventory rows', possibly a typo), and 27,842 mobile device logs containing phone numbers, emails and IMEI numbers. The group framed the demand against the former LF Logistics arm, saying $5M is 'roughly four hours of that EBITDA'. All claims are unverified.

Maersk confirmed that a threat actor breached systems of a company it previously acquired and stole data. The platform traces to LF Logistics, which Maersk acquired from the Li & Fung Group in 2022 and which originally developed the OCF/LF Logistics platform. Maersk states the incident is 'isolated to a local system', that no sensitive data has been disclosed according to current evidence, that it does not expect operational disruption, and that other Maersk systems and customer/partner API and EDI connections are unaffected. Maersk did not disclose the affected system, data types or intrusion date, and the investigation is ongoing. There is a discrepancy between Maersk's statement and the actor's claim of plaintext passwords and privileged accounts.

No initial access vector, tooling, CVE, malware or IOCs have been published. Sourced activity is limited to compromise of a legacy system, data theft and leak-site extortion. WatchGuard classes WhiteArmor as crypto-ransomware using direct, double and free-leak extortion, but no encryption was reported at Maersk. Per Breachsense, WhiteArmor has named 15 victims since 2026-10-22, with logistics the most frequent sector (Maersk, Echo Global Logistics, Ryder System, J.B. Hunt Transport Services). Other listed victims include Whirlpool, Hisense, Unilever, KuCoin and Lovesac. WatchGuard lists demands from $140,000 to $20,000,000.

## MITRE ATT&CK

- T1005 Data from Local System
- T1552 Unsecured Credentials
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**WhiteArmor Contact Channels - Web Proxy Access to Leak Site, Telegram and X Accounts** (`TL-2026-5781-SPL-003`)

Detects web-proxy requests to WhiteArmor infrastructure: the clearnet site whitearmor.cc, the Tor leak site whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion, the Telegram channel t.me/whitearmorxd and the X account WhiteArmorxd. Indicates operator contact, negotiation or leak-site browsing (T1657, T1102, T1090.003, T1071.001).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1657, T1102, T1090.003, T1071.001
- **Data sources:** proxy
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype IN ("pan:traffic","zscaler:nss-web","bluecoat:proxysg:access:syslog","squid:access") earliest=-24h
| eval target=lower(coalesce(url, uri, url_domain, dest_host))
| where match(target,"(^|[./@])whitearmor\.cc") OR match(target,"whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad") OR match(target,"(t\.me|x\.com|twitter\.com)/whitearmorxd") OR match(target,"\.onion(:[0-9]+)?(/|$)")
| stats count min(_time) as first_seen max(_time) as last_seen values(target) as urls by src_ip, user
| sort - count
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend Target = tolower(coalesce(RequestURL, DestinationHostName))
| where Target has_any ("whitearmor.cc", "whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad", "t.me/whitearmorxd", "x.com/whitearmorxd", "twitter.com/whitearmorxd") or Target matches regex @"\.onion(:[0-9]+)?(/|$)"
| project TimeGenerated, SourceIP, SourceUserName, DestinationIP, Target, DeviceVendor
```

### Sigma

```yaml
title: Access to WhiteArmor Leak Site and Contact Channels
id: 5f0c2a41-7b1e-5d3a-9c64-2e8a1b7d0a03
status: experimental
description: Detects proxy requests to whitearmor.cc, the WhiteArmor Tor leak site, or the WhiteArmor Telegram and X accounts (TL-2026-5781).
references:
    - https://www.bleepingcomputer.com/news/security/maersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million/
    - https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/whitearmor
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.command-and-control
    - attack.t1102
    - attack.t1090.003
    - attack.t1071.001
    - attack.impact
    - attack.t1657
logsource:
    category: proxy
detection:
    selection_domain:
        cs-host|endswith:
            - 'whitearmor.cc'
            - 'whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion'
    selection_social:
        c-uri|contains:
            - 't.me/whitearmorxd'
            - 'x.com/WhiteArmorxd'
    condition: 1 of selection_*
falsepositives:
    - Threat-intelligence analysts browsing the leak site from a research network
    - Security awareness material referencing the group
level: high

```

**Known false positives:**

- Threat-intel or incident-response staff intentionally visiting WhiteArmor infrastructure
- Security awareness mail or sandbox detonation of linked URLs

**Tuning notes:** Exclude analyst research subnets. Any hit from a production server or logistics platform host should be treated as high priority.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Privileged Account Creation and Admin Group Membership Bursts on Legacy Platform Hosts (locked: unlock with TL Creds)
- Data Staging - Password-Protected Archive of Database, Inventory or Driver Exports (locked: unlock with TL Creds)
- Tor Client or Onion Connection from Servers - WhiteArmor Leak Site Infrastructure (locked: unlock with TL Creds)
- Ransomware Precursor - Backup, Shadow Copy and Recovery Inhibition (locked: unlock with TL Creds)
- Exfiltration Tooling - Rclone, MEGAcmd, WinSCP, AzCopy and Curl Uploads (locked: unlock with TL Creds)
- DNS Resolution of WhiteArmor Leak Site and Onion Domains (locked: unlock with TL Creds)
- WhiteArmor Data Theft - Bulk Upload to File-Sharing Services or WhiteArmor Infrastructure (locked: unlock with TL Creds)
- WhiteArmor Credential Harvesting - Plaintext Password Search in Configuration and Data Files (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 11)

Defanged, TLP:CLEAR.

- Domain: `whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad[.]onion`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Maersk confirms data breach as WhiteArmor ransomware demands $5 million](https://www.bleepingcomputer.com/news/security/maersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million/)
- [Maersk statement: IT security incident](https://www.maersk.com/news/articles/2026/11/11/it-security-incident)
- [WatchGuard Ransomware Tracker: WhiteArmor](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/whitearmor)
- [Breachsense: WhiteArmor ransomware group](https://www.breachsense.com/ransomware-groups/whitearmor/)
- [Breachsense: Maersk data breach claim](https://www.breachsense.com/breaches/maersk-data-breach/)
- [BleepingComputer: Maersk Reinstalled 45,000 PCs and 4,000 Servers to Recover From NotPetya Attack](https://www.bleepingcomputer.com/news/security/maersk-reinstalled-45-000-pcs-and-4-000-servers-to-recover-from-notpetya-attack/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5781