Skip to content
Leak-site post naming AT&T, captured by ThreatCluster
Back to victims

AT&T

endzone

Ransomware leak-site victim intelligence · EN

Posted
Sep 18, 2026
Publication
Sep 24, 2026
Country
US
Industry
Technology

What was taken

Initial access was via a CX contractor doing business with AT&T. Access originally used as vehicle for Equipment Changes/Call Forwarding (thanks a lot TORCH patch) - VPN + HVD (both external and internal MyDesktop) instances were accessed for a prolonged period without any detection or incident response taking place. Certificates exported from certlm in the VDI + OPUS self installer (automatically joins EP to S1) opened up the door to the VPN. Salesforce data was accessed via a project manager ATTUID + a DirecTV contractor who for some reason had the apps available in Salesforce. AT&T CSO, if you are reading this, you are to contact us ASAP!

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Screenshot of a software interface titled "OPUS Self Install Tool" with a "Start" button and version information at the bottom.
onion leak page12 KB
Image of a loading screen for the "OPUS Self Install Tool" with a loading indicator.
onion leak page12 KB
Screenshot of a software installation progress window showing a download status of 16.3 MB out of 30.6 MB.
onion leak page9.9 KB
Screenshot of a VPN connection interface displaying connection status and corporate information.
onion leak page11 KB
Screenshot of a certificate details window displaying information such as validity, subject, public key, and key usage.
onion leak page10 KB
Screenshot of a role description document with fields including Role Name, Description, Primary Group, Readonly, and various intended users.
onion leak page9.9 KB
Directory listing of folders including names like Adobe, Cisco, Citrix, and FireEye.
onion leak page9.5 KB
Screenshot of a software interface titled "OPUS Self Install Tool" with a "Start" button and a help section.
onion leak page87 KB
The image displays a loading screen for the "OPUS Self Install Tool," featuring a wrench icon and the word "loading..." in a stylized font.
onion leak page59 KB
Progress window for software installation, showing a green progress bar and details about the installation of "RetailApps" from an AT&T source.
onion leak page64 KB