Pixelleaks (new group) claims data leak from Huangshi Medical Laboratory / Ezong Medical Group x Getein JV (China, healthcare)

Key facts

Detection coverage

As of 2026-11-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6103 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Pixelleaks Tor Leak-Site Access or Tor Client Execution

Pixelleaks extortion group operates a Tor leak site (pixelra2qbx7zhvb6mxdzxlo6rxm2mtouhbabqmdzyd4fesicvbz7bqd.onion). Fires on Sysmon DNS queries for .onion names (including the Pixelleaks address) or execution of Tor client binaries/arguments on managed hosts. Behaviour-first; no malware or exploit is documented for Pixelleaks.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1583, T1567
• Data sources: sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 1 and 22)
• Severity: medium
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=22)
| eval q=lower(coalesce(QueryName,"")), img=lower(coalesce(Image,"")), cl=lower(coalesce(CommandLine,""))
| eval onion_hit=if(EventCode=22 AND (like(q,"%.onion") OR like(q,"%pixelra2qbx7zhvb6mxdzxlo6rxm2mtouhbabqmdzyd4fesicvbz7bqd%")),1,0)
| eval tor_proc=if(EventCode=1 AND (like(img,"%\\tor.exe") OR like(img,"%\\obfs4proxy.exe") OR like(cl,"%--socksport%") OR like(cl,"%--controlport%") OR like(cl,"%pixelra2qbx7zh%")),1,0)
| where onion_hit=1 OR tor_proc=1
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as images values(QueryName) as onion_queries values(CommandLine) as cmdlines by host User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let onion = "pixelra2qbx7zhvb6mxdzxlo6rxm2mtouhbabqmdzyd4fesicvbz7bqd.onion";
union
(DeviceNetworkEvents
 | where Timestamp > ago(24h)
 | where RemoteUrl endswith ".onion" or RemoteUrl has onion
 | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Process=InitiatingProcessFileName, CommandLine=InitiatingProcessCommandLine, Indicator=RemoteUrl, Signal="onion_connection"),
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where FileName in~ ("tor.exe", "obfs4proxy.exe") or ProcessCommandLine has_any ("--SocksPort", "--ControlPort") or ProcessCommandLine has "pixelra2qbx7zh"
 | project Timestamp, DeviceName, AccountName, Process=FileName, CommandLine=ProcessCommandLine, Indicator=FolderPath, Signal="tor_process")
| order by Timestamp desc

Sigma

title: Tor Client Process or Pixelleaks Onion Reference on Endpoint
id: 6f1c2a4e-3b7d-4e58-9a10-5c2d8e7b1a01
status: experimental
description: Detects Tor client binaries or command lines referencing the Pixelleaks leak-site onion address; servers holding sensitive records should not run Tor.
references:
    - https://www.ransomware.live/
    - https://www.breachsense.com/ransomware-groups/pixelleaks/
author: Threadlinqs Team
date: 2026-11-15
tags:
    - attack.resource-development
    - attack.t1583
    - attack.exfiltration
    - attack.t1567
    - attack.command-and-control
    - attack.t1090.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\tor.exe'
            - '\obfs4proxy.exe'
    selection_cli:
        CommandLine|contains:
            - '--SocksPort'
            - '--ControlPort'
            - 'pixelra2qbx7zh'
    condition: 1 of selection_*
falsepositives:
    - Authorised privacy research or Tor Browser use by analysts
    - Security teams testing leak-site reachability
level: medium

Known false positives:

• Analysts or researchers legitimately using Tor Browser
• Security tooling that resolves .onion names for threat-intel validation

Tuning notes: Allow-list analyst workstations and research VMs by host. Prioritise hits from servers or hosts holding HR, finance and client-record data. Attribution is low-confidence, so treat any Tor use on such hosts as suspicious regardless of the Pixelleaks address.

• 🔒 Pixelleaks Leak-Site Access via Tor - Network Telemetry · unlock with TL Creds
• 🔒 Pixelleaks Mass Collection - Bulk Reads of Record Shares · unlock with TL Creds
• 🔒 Pixelleaks Exfiltration - Large Outbound Transfers to File-Hosting Services · unlock with TL Creds
• 🔒 Pixelleaks Onion Domain DNS Query · unlock with TL Creds
• 🔒 Database Export of Personnel, Finance or Client Tables · unlock with TL Creds
• 🔒 Scripted Data Upload via curl or PowerShell · unlock with TL Creds
• 🔒 Pixelleaks Data Staging - Archiving Personnel, Finance and Client Records · unlock with TL Creds
• 🔒 Pixelleaks Exfiltration Tooling - rclone and MEGA Sync Clients · unlock with TL Creds

Indicators of compromise

As of 2026-11-15, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-6103.

Sample indicators (2 of 12)

• Domain: pixelra2qbx7zhvb6mxdzxlo6rxm2mtouhbabqmdzyd4fesicvbz7bqd[.]onion
• URL: hxxps://www[.]ransomware[.]live/id/SHVhbmdzaGkgTWVkaWNhbCBMYWJvcmF0b3J5ICjpu4Tnn7PljLvlhbvljLvlrabmo4DpqowpIC8gRXpvbmcgTWVkaWNhbCBHcm91cCB4IEdldGVpbiBKVkBQaXhlbExlYWtz

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

Technical analysis

On 2026-11-15 (09:06 UTC) ransomware.live recorded a new victim listing attributed to a group named Pixelleaks: Huangshi Medical Laboratory (黄石医养医学检验) / Ezong Medical Group x Getein JV, a China-based medical laboratory / in-vitro diagnostics (IVD) supply chain organization. The listing describes 'a verified set of records' scheduled for publication, said to include personnel, financial and client records, and gives a deadline of 2026-11-17 20:37 UTC. The estimated attack date is 2026-11-15. The aggregator explicitly says the claim should be treated with caution until independently verified. No ransom amount, ransom note, screenshots, victim domain, CVE, malware, or initial-access method is stated.

Pixelleaks appears to be a new double-extortion / data-leak group. Breachsense (data as of 2026-11-13) lists the group as active with 17 named victims, first recorded 2026-11-09 (TDS Tech, Vietnam), followed by victims on 2026-11-10, 11-11 and a batch of eleven on 2026-11-13 (financial services, healthcare, education, manufacturing, non-profit, energy, telecommunications and technology; mostly United States, plus Canada, Vietnam, China, Peru, Spain, Singapore). Breachsense notes the first-victim date reflects when the group entered its collection, not necessarily the start of operations. Its single tracked Tor leak site is pixelra2qbx7zhvb6mxdzxlo6rxm2mtouhbabqmdzyd4fesicvbz7bqd.onion. TheHackerWire's thin profile conflicts with this: it shows one claimed victim (technology, Italy, 2026-11-09) and marks the Tor leak site offline. Neither source provides TTPs, tooling, contact details, or attribution; the Hacker Wire page links to unrelated groups (n0n, medusalocker, Vortex, Climax Inc, Curious Worm, everest) without stating any connection, so no relationship is asserted.

MITRE mapping note: no source documents the intrusion method. The ATT&CK mappings are limited to behaviors implied by a data-theft-and-leak extortion claim (leak-site infrastructure, collection and exfiltration of records, extortion) and should be treated as low-confidence until victim or incident-response evidence emerges. The page footer of ransomware.live shows a Session ID and Tox ID, but they are site-wide and not tied to this victim, so they are deliberately omitted. Defenders in the healthcare / IVD supply chain should treat this as an unverified claim, monitor the deadline, and review exposure of personnel, finance and client data repositories.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583 Acquire Infrastructure

Impact

T1657 Financial Theft

Remediation

Immediate actions

• Treat the Pixelleaks claim as unverified; validate whether personnel, financial and client records were accessed or exfiltrated
• Review outbound data transfers and file-share / database access logs for 2026-11-01 onward
• Block access to and alert on connections to Tor infrastructure from servers holding sensitive records
• Prepare notification and legal response ahead of the 2026-11-17 20:37 UTC claimed deadline

Longer-term hardening

• Segment and restrict access to HR, finance and client-record repositories
• Deploy DLP and egress monitoring for bulk data staging and exfiltration
• Maintain tested offline backups and an extortion/data-leak incident response playbook
• Monitor leak sites and ransomware trackers for organization and subsidiary names

Affected and fixed versions

• Huangshi Medical Laboratory (黄石医养医学检验) / Ezong Medical Group x Getein JV — Organization data (personnel, financial, client records)

Timeline

• 2026-11-09 Breachsense records the first Pixelleaks leak-site victim, TDS Tech (Vietnam); TheHackerWire also dates its single disclosure to 2026-11-09.
• 2026-11-10 Further victims posted: Al Enaya General Trading, Jiangsu Hengsheng Information Technology and Suiza Lab (per Breachsense).
• 2026-11-11 PC Express (Spain) and TDS Technology posted (per Breachsense).
• 2026-11-13 Eleven victims posted in one day, including Boston Institute of Finance, iBEAM, King International Investment and International Utility Specialists (per Breachsense).
• 2026-11-15 ransomware.live discovers (09:06 UTC) the Huangshi Medical Laboratory / Ezong Medical Group x Getein JV listing attributed to Pixelleaks; estimated attack date 2026-11-15.
• 2026-11-17 Stated deadline (20:37 UTC) after which Pixelleaks says personnel, financial and client records will be published.

Sources cited

• ransomware.live victim entry: Huangshi Medical Laboratory / Ezong Medical Group x Getein JV (Pixelleaks) ransomware.live · Research · 2026-11-15
• Breachsense: PixelLeaks ransomware group profile breachsense.com · Research · 2026-11-13
• Ransomware.live ransomware group and victim tracker ransomware.live · Research · 2026-11-15
• RansomLook group profiles ransomlook.io · Research · 2026-11-15
• TheHackerWire: pixelleaks adversary profile thehackerwire.com · News · 2026-11-09

More in ransomware

• Ransomware Leak-Site Cadence Analysis: INCRANSOM, TheGentlemen and Audit Team Run Active Intrusion Pipelines Amid Group Consolidation
• Vexy Ransomware lists Upper Web (Brazil, Technology) as a victim
• AI-Enabled Ransomware Evolution: Machine-Speed Kill Chains and Initial Access Broker Disruption (TrendAI Assessment, ARTEX Agentic Exploitation Context)
• Everest ransomware leak-site listing: "Final Notice Before Publication" (victim unnamed)
• Qilin Ransomware Claims Cyberattack on University of Texas at Arlington; Personal Data Stolen