# Pixelleaks (new group) claims data leak from Huangshi Medical Laboratory / Ezong Medical Group x Getein JV (China, healthcare)

> Ransomware.live lists Huangshi Medical Laboratory (黄石医养医学检验) / Ezong Medical Group x Getein JV, a medical laboratory / IVD supply chain organization in China, as a victim of the newly observed Pixelleaks extortion group. The claimed material includes personnel, financial and client records, with a stated publication deadline of 2026-11-17 20:37 UTC; the claim is unverified.

- **Published:** 2026-11-15T09:21:29Z
- **Last reviewed:** 2026-11-15T09:21:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6103
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6103.png
- **ID:** TL-2026-6103
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Pixelleaks
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (2 shown free below)

## Description

On 2026-11-15 (09:06 UTC) ransomware.live recorded a new victim listing attributed to a group named Pixelleaks: Huangshi Medical Laboratory (黄石医养医学检验) / Ezong Medical Group x Getein JV, a China-based medical laboratory / in-vitro diagnostics (IVD) supply chain organization. The listing describes 'a verified set of records' scheduled for publication, said to include personnel, financial and client records, and gives a deadline of 2026-11-17 20:37 UTC. The estimated attack date is 2026-11-15. The aggregator explicitly says the claim should be treated with caution until independently verified. No ransom amount, ransom note, screenshots, victim domain, CVE, malware, or initial-access method is stated.

Pixelleaks appears to be a new double-extortion / data-leak group. Breachsense (data as of 2026-11-13) lists the group as active with 17 named victims, first recorded 2026-11-09 (TDS Tech, Vietnam), followed by victims on 2026-11-10, 11-11 and a batch of eleven on 2026-11-13 (financial services, healthcare, education, manufacturing, non-profit, energy, telecommunications and technology; mostly United States, plus Canada, Vietnam, China, Peru, Spain, Singapore). Breachsense notes the first-victim date reflects when the group entered its collection, not necessarily the start of operations. Its single tracked Tor leak site is pixelra2qbx7zhvb6mxdzxlo6rxm2mtouhbabqmdzyd4fesicvbz7bqd.onion. TheHackerWire's thin profile conflicts with this: it shows one claimed victim (technology, Italy, 2026-11-09) and marks the Tor leak site offline. Neither source provides TTPs, tooling, contact details, or attribution; the Hacker Wire page links to unrelated groups (n0n, medusalocker, Vortex, Climax Inc, Curious Worm, everest) without stating any connection, so no relationship is asserted.

MITRE mapping note: no source documents the intrusion method. The ATT&CK mappings are limited to behaviors implied by a data-theft-and-leak extortion claim (leak-site infrastructure, collection and exfiltration of records, extortion) and should be treated as low-confidence until victim or incident-response evidence emerges. The page footer of ransomware.live shows a Session ID and Tox ID, but they are site-wide and not tied to this victim, so they are deliberately omitted. Defenders in the healthcare / IVD supply chain should treat this as an unverified claim, monitor the deadline, and review exposure of personnel, finance and client data repositories.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Pixelleaks Tor Leak-Site Access or Tor Client Execution** (`TL-2026-6103-SPL-001`)

Pixelleaks extortion group operates a Tor leak site (pixelra2qbx7zhvb6mxdzxlo6rxm2mtouhbabqmdzyd4fesicvbz7bqd.onion). Fires on Sysmon DNS queries for .onion names (including the Pixelleaks address) or execution of Tor client binaries/arguments on managed hosts. Behaviour-first; no malware or exploit is documented for Pixelleaks.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1583, T1567
- **Data sources:** sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 1 and 22)
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=22)
| eval q=lower(coalesce(QueryName,"")), img=lower(coalesce(Image,"")), cl=lower(coalesce(CommandLine,""))
| eval onion_hit=if(EventCode=22 AND (like(q,"%.onion") OR like(q,"%pixelra2qbx7zhvb6mxdzxlo6rxm2mtouhbabqmdzyd4fesicvbz7bqd%")),1,0)
| eval tor_proc=if(EventCode=1 AND (like(img,"%\\tor.exe") OR like(img,"%\\obfs4proxy.exe") OR like(cl,"%--socksport%") OR like(cl,"%--controlport%") OR like(cl,"%pixelra2qbx7zh%")),1,0)
| where onion_hit=1 OR tor_proc=1
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as images values(QueryName) as onion_queries values(CommandLine) as cmdlines by host User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let onion = "pixelra2qbx7zhvb6mxdzxlo6rxm2mtouhbabqmdzyd4fesicvbz7bqd.onion";
union
(DeviceNetworkEvents
 | where Timestamp > ago(24h)
 | where RemoteUrl endswith ".onion" or RemoteUrl has onion
 | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Process=InitiatingProcessFileName, CommandLine=InitiatingProcessCommandLine, Indicator=RemoteUrl, Signal="onion_connection"),
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where FileName in~ ("tor.exe", "obfs4proxy.exe") or ProcessCommandLine has_any ("--SocksPort", "--ControlPort") or ProcessCommandLine has "pixelra2qbx7zh"
 | project Timestamp, DeviceName, AccountName, Process=FileName, CommandLine=ProcessCommandLine, Indicator=FolderPath, Signal="tor_process")
| order by Timestamp desc
```

### Sigma

```yaml
title: Tor Client Process or Pixelleaks Onion Reference on Endpoint
id: 6f1c2a4e-3b7d-4e58-9a10-5c2d8e7b1a01
status: experimental
description: Detects Tor client binaries or command lines referencing the Pixelleaks leak-site onion address; servers holding sensitive records should not run Tor.
references:
    - https://www.ransomware.live/
    - https://www.breachsense.com/ransomware-groups/pixelleaks/
author: Threadlinqs Team
date: 2026-11-15
tags:
    - attack.resource-development
    - attack.t1583
    - attack.exfiltration
    - attack.t1567
    - attack.command-and-control
    - attack.t1090.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\tor.exe'
            - '\obfs4proxy.exe'
    selection_cli:
        CommandLine|contains:
            - '--SocksPort'
            - '--ControlPort'
            - 'pixelra2qbx7zh'
    condition: 1 of selection_*
falsepositives:
    - Authorised privacy research or Tor Browser use by analysts
    - Security teams testing leak-site reachability
level: medium

```

**Known false positives:**

- Analysts or researchers legitimately using Tor Browser
- Security tooling that resolves .onion names for threat-intel validation

**Tuning notes:** Allow-list analyst workstations and research VMs by host. Prioritise hits from servers or hosts holding HR, finance and client-record data. Attribution is low-confidence, so treat any Tor use on such hosts as suspicious regardless of the Pixelleaks address.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Pixelleaks Leak-Site Access via Tor - Network Telemetry (locked: unlock with TL Creds)
- Pixelleaks Mass Collection - Bulk Reads of Record Shares (locked: unlock with TL Creds)
- Pixelleaks Exfiltration - Large Outbound Transfers to File-Hosting Services (locked: unlock with TL Creds)
- Pixelleaks Onion Domain DNS Query (locked: unlock with TL Creds)
- Database Export of Personnel, Finance or Client Tables (locked: unlock with TL Creds)
- Scripted Data Upload via curl or PowerShell (locked: unlock with TL Creds)
- Pixelleaks Data Staging - Archiving Personnel, Finance and Client Records (locked: unlock with TL Creds)
- Pixelleaks Exfiltration Tooling - rclone and MEGA Sync Clients (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 12)

Defanged, TLP:CLEAR.

- Domain: `pixelra2qbx7zhvb6mxdzxlo6rxm2mtouhbabqmdzyd4fesicvbz7bqd[.]onion`
- URL: `hxxps://www[.]ransomware[.]live/id/SHVhbmdzaGkgTWVkaWNhbCBMYWJvcmF0b3J5ICjpu4Tnn7PljLvlhbvljLvlrabmo4DpqowpIC8gRXpvbmcgTWVkaWNhbCBHcm91cCB4IEdldGVpbiBKVkBQaXhlbExlYWtz`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ransomware.live victim entry: Huangshi Medical Laboratory / Ezong Medical Group x Getein JV (Pixelleaks)](https://www.ransomware.live/id/SHVhbmdzaGkgTWVkaWNhbCBMYWJvcmF0b3J5ICjpu4Tnn7PljLvlhbvljLvlrabmo4DpqowpIC8gRXpvbmcgTWVkaWNhbCBHcm91cCB4IEdldGVpbiBKVkBQaXhlbExlYWtz)
- [Breachsense: PixelLeaks ransomware group profile](https://www.breachsense.com/ransomware-groups/pixelleaks/)
- [TheHackerWire: pixelleaks adversary profile](https://www.thehackerwire.com/?p=30812)
- [Ransomware.live ransomware group and victim tracker](https://www.ransomware.live/)
- [RansomLook group profiles](https://www.ransomlook.io/groups)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6103