Whitearmor

WhiteArmor is a data-theft and extortion group that appeared in October 2026. It claimed its first victim, Whirlpool, around 21 October 2026, and runs a Tor data leak site plus a clearnet mirror (whitearmor.cc). Within its first week it named 14-19 organisations, mainly in the United States, across the transportation/logistics (J.B. Hunt, Ryder, Echo Global Logistics), retail (Lovesac), consumer electronics (Hisense), online gambling (Gamdom) and political (Partido Liberal, Argentina) sectors. Its most publicised claim is 19 GB of Hisense warranty, customer, supplier and CRM data covering Malaysia and Singapore, for which it demanded USD 5 million in Bitcoin, reportedly raised from USD 500,000. Reports describe an affiliate model with a 5% operator fee and say the group is recruiting pentesters, web exploitation specialists and zero-day researchers. No encryptor has been publicly analysed, and none of the victim claims had been independently confirmed at the time of reporting.

Recent activity

• 🛡 THREAT INTEL | Unilever 🟢 Actor Whitearmor claims 79GB Allegedly exposed • Email addresses • Invoices • Personal data ⚠️ Unverified claim https://www. yazou
  mastodon · Nov 5, 2026
• 🚨New ransom group blog posts!🚨 Group name: Dark Project Post title: Food Bank of Central Louisiana Location: 🇺🇸 US Sector: Other Info: https:// cti.fyi/#dis
  mastodon · Nov 4, 2026
• 🚨New ransom group blog posts!🚨 Group name: direwolf Post title: 🇺🇸 My Cloud Grocer Organization: My Cloud Grocer Location: 🇺🇸 US Sector: Other Info: https
  mastodon · Nov 1, 2026
• 🚨New ransom group blog posts!🚨 Group name: qilin Post title: Community Medical Center, Falls City Nebraska Organization: Community Medical Center Location: 🇺
  mastodon · Oct 31, 2026
• 🚨New ransom group blog post!🚨 Group name: Whitearmor Post title: rolly.io Sector: Technology Info: https:// cti.fyi/#disclosure/Whitearmor /rolly.io # ransomw
  mastodon · Oct 29, 2026
• 🚨New ransom group blog posts!🚨 Group name: Whitearmor Post title: Echo.com Organization: Echo Global Logistics Location: 🇺🇸 US Sector: Other Info: https://
  mastodon · Oct 28, 2026
• 🚨New ransom group blog post!🚨 Group name: Whitearmor Post title: Ryder Location: 🇺🇸 US Sector: Other Info: https:// cti.fyi/#disclosure/Whitearmor /Ryder #
  mastodon · Oct 27, 2026
• 🚨New ransom group blog posts!🚨 Group name: rhysida Post title: Machelen (Belgium) Organization: Machelen Location: 🇧🇪 BE Info: https:// cti.fyi/#disclosure/
  mastodon · Oct 27, 2026
• 🚨New ransom group blog posts!🚨 Group name: direwolf Post title: 🇲🇽 GRUPO PETROIL Organization: Grupo Petroil Location: 🇲🇽 MX Sector: Energy Utilities Info
  mastodon · Oct 27, 2026
• 🚨New ransom group blog post!🚨 Group name: Whitearmor Post title: gamblinglore Sector: Media Entertainment Info: https:// cti.fyi/#disclosure/Whitearmor /gambl
  mastodon · Oct 27, 2026
• 🚨New ransom group blog post!🚨 Group name: Whitearmor Post title: Verification Organization: Gamblinglore Sector: Media Entertainment Info: https:// cti.fyi/#d
  mastodon · Oct 27, 2026
• 🚨New ransom group blog posts!🚨 Group name: metaencryptor Post title: ST Engineering Location: 🇸🇬 SG Sector: Aerospace Defense Info: https:// cti.fyi/#disclo
  mastodon · Oct 26, 2026
• 🚨New ransom group blog post!🚨 Group name: Whitearmor Post title: LoveSac Location: 🇺🇸 US Sector: Other Info: https:// cti.fyi/#disclosure/Whitearmor /LoveSa
  mastodon · Oct 26, 2026
• 🚨New ransom group blog post!🚨 Group name: Whitearmor Post title: J.B Hunt Organization: J.B. Hunt Location: 🇺🇸 US Sector: Other Info: https:// cti.fyi/#disc
  mastodon · Oct 26, 2026
• 🚨New ransom group blog posts!🚨 Group name: anubis Post title: Newcomer Cremations, Funerals Receptions Sector: Professional Services Info: https:// cti.fyi/#d
  mastodon · Oct 25, 2026
• 🚨New ransom group blog posts!🚨 Group name: qilin Post title: Hossner-Textil GmbH Location: 🇩🇪 DE Sector: Manufacturing Info: https:// cti.fyi/#disclosure/qi
  mastodon · Oct 25, 2026
• 🚨New ransom group blog posts!🚨 Group name: Emperador Post title: AB InBev Location: 🇧🇪 BE Sector: Manufacturing Info: https:// cti.fyi/#disclosure/Emperador
  mastodon · Oct 25, 2026
• 🚨New ransom group blog posts!🚨 Group name: qilin Post title: Miljaus Producciones S.L (www.miljaus.com) Organization: Miljaus Producciones S.L Location: 🇪🇸
  mastodon · Oct 23, 2026
• 🚨New ransom group blog posts!🚨 Group name: interlock Post title: Custom Floors Unlimited Location: 🇺🇸 US Sector: Manufacturing Info: https:// cti.fyi/#discl
  mastodon · Oct 23, 2026

References

• https://www.infostealers.com/article/38628-crypto-orders-10139-ips-what-wagyus-alleged-leak-means-for-monero-privacy/
• https://teiss.co.uk/news/whitearmor-ransomware-group-claims-hisense-data-theft-demands-5-million-18363
• https://cybernews.com/security/ransomware-operator-claims-hisense-demands-5-million/
• https://www.ransomlook.io/group/whitearmor

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.