World Leaks Attack Exfiltrated Data and Encrypted a Healthcare Organization’s Files
Summary
Darktrace reports that World Leaks attackers spent about three months inside a healthcare organization’s network, exfiltrated data to cloud storage, and encrypted files—contradicting the group’s reported shift to extortion without encryption.
Key points
- Darktrace identified a World Leaks attack on a healthcare organization in January 2026; investigators traced likely initial access to a Fortigate appliance in October 2025.
- The attackers used a compromised administrator credential, brute-force activity, and tools including PsExec for lateral movement.
- They used Cloudflare Tunnel and other remote-access methods, and transferred more than 80 GB of data to MEGA in late December; Backblaze was also used.
- Darktrace observed Rclone in MEGA transfer user-agent data, along with suspicious connections to external IP addresses assessed as possible command-and-control infrastructure.
- Ransom notes, encrypted-file extensions, and files named world.exe and task.bat indicated that the attack included encryption as well as data theft.
- Darktrace’s Autonomous Response initially blocked suspicious connectivity, but the attack continued after time-limited mitigations expired; response actions were applied as the intrusion progressed.
Article Details
- Victim Organization
- Not disclosed
- Victim Domain
- Not disclosed
- Incident Type
- Ransomware attack involving data exfiltration and encryption
- Disclosure Date
- 2026-03-17
- Data Types Exposed
- Customer data; specific data types not disclosed
- Affected Records
- Not disclosed
- Affected Data Size
- More than 80 GB transferred to MEGA in late December 2025
- Operational Impact
- Customer data was encrypted. The article does not report broader operational disruption.
- Ransom Or Extortion
- A ransom note was found and attributed the incident to World Leaks. The article does not report whether a ransom was demanded or paid.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | h2[.]cftunnel[.]com | Hostname involved in tunneling activity attributed by Darktrace to the World Leaks attack. |
| HOSTNAME | region1[.]v2[.]argotunnel[.]com | Hostname involved in tunneling activity attributed by Darktrace to the World Leaks attack. |
| HOSTNAME | region2[.]v2[.]argotunnel[.]com | Hostname involved in tunneling activity attributed by Darktrace to the World Leaks attack. |
| IPV4 | 193[.]161[.]193[.]99 | External IP making anomalous connections to the victim network; reported as probable C2 infrastructure and possibly used to obfuscate C2 communications. |
| IPV4 | 51[.]15[.]109[.]222 | External IP used for anomalous SSH connections between the actors and victim machines; listed as possible C2 infrastructure. |
MITRE ATT&CK
T1018 · Remote System DiscoveryThe article maps remote system discovery to the attack.T1021 · Remote ServicesRemote services were used for lateral movement.T1021.001 · Remote Desktop ProtocolRDP was used to access local devices in the victim network.T1021.002 · SMB/Windows Admin SharesSMB was used for lateral movement and file transfers.T1021.006 · Windows Remote ManagementThe article maps Windows Remote Management to lateral movement.T1039 · Data from Network Shared DriveThe article maps collection from network shared drives to the attack.T1041 · Exfiltration Over C2 ChannelThe article maps exfiltration over a C2 channel to the attack.T1046 · Network Service DiscoveryPort and network scanning was conducted to identify open ports and services.T1047 · Windows Management InstrumentationThe article maps Windows Management Instrumentation activity to the attack.T1048 · Exfiltration Over Alternative ProtocolThe article maps exfiltration over an alternative protocol to the attack.T1074 · Data StagedThe article maps data staging to the attack.T1078 · Valid AccountsCompromised valid credentials were used to access and move through the victim network.T1083 · File and Directory DiscoveryThe article maps file and directory discovery to the attack.T1110 · Brute ForceBrute-force activity using a compromised administrator credential was observed.T1110.001 · Password GuessingThe article maps password guessing to the credential-access activity.T1135 · Network Share DiscoveryThe article maps network share discovery to the attack.T1190 · Exploit Public-Facing ApplicationThe article maps exploitation of public-facing applications to this technique.T1219 · Remote Access ToolsRemote access tooling, including Chrome Remote Desktop, was used during the intrusion.T1219.002 · Remote Desktop SoftwareChrome Remote Desktop was used by the threat actor.T1567.002 · Exfiltration to Cloud StorageMore than 80 GB of data was transferred to MEGA, a cloud storage service.T1569.002 · Service ExecutionThe article maps service execution to the attack.T1570 · Lateral Tool TransferFiles were transferred over SMB between devices in the victim network.T1571 · Non-Standard PortThe article maps use of a non-standard port to the attack.T1572 · Protocol TunnelingCloudflare Tunnel was used for tunneling activity.T1595.001 · Scanning IP BlocksNetwork scanning was observed during reconnaissance.T1595.002 · Vulnerability ScanningThe article maps vulnerability scanning to the reconnaissance activity.
People
Threat Actors
Hive RansomwareListed by the article as a known association of World Leaks.Hunters InternationalThe article describes World Leaks as a rebrand of Hunters International.Secp0 RansomwareListed by the article as a known association of World Leaks.UNC6148Listed by the article as a known association of World Leaks.World LeaksDarktrace attributed the attack to World Leaks based on the ransom note and its investigation; the article reports encryption and exfiltration in this incident.
Vendors
Backblazedata exfiltration. Multiple local devices within the compromised network began transferring data to Backblaze and MEGA domains, both of which provide cloud storage services; 80+GB of data was transferred to MEGA inCloudflareliving-off-the-land (LOTL) techniques for lateral movement. C2 communications were established using Cloudflare Tunnel (formerly Argo Tunnel). As part of the Actions on Objectives attack phase, a significant volumeDarktraceexfiltration tooling with SOCKSv5 proxy and TOR-based communications [4]. However, in early 2026, Darktrace detected an incident that directly contradicted this claim: World Leaks carried out an attack that
Products
Chrome Remote Desktopconnecting to the hostname remotedesktop-pa[.]googleapis[.]com, an API endpoint required for Chrome Remote Desktop, indicating that Chrome RDP was used by the threat actor in this stage of the attack.Cloudflare Tunnel(LOTL) techniques for lateral movement. C2 communications were established using Cloudflare Tunnel (formerly Argo Tunnel). As part of the Actions on Objectives attack phase, a significant volume ofMEGAsoftware tooling via TOR connections. Cloud storage services used for exfiltration particularly include MEGA. World Leaks also carry out direct data transfer through established command-and-control (C2)
Tools
PsExecSMB, RDP, and SSH are used for lateral movement via remote services. Notably, the group is also known to use PsExec and Rclone as part of their lateral movement activities.RCloneSMB, RDP, and SSH are used for lateral movement via remote services. Notably, the group is also known to use PsExec and Rclone as part of their lateral movement activities.