Summary
Written by ThreatClusterfrom file listing, victim profile, leak post, screenshot, ransom noteEverest group claims Keysight Technologies' data archive includes source code, Git repositories, test platforms, automation systems, firmware, release packages, configurations, diagnostic archives, and engineering materials, totaling about 489 GB on disk (roughly 1.38 TB unpacked and about 1.05 million files). The leak post states the publication status is published and that the files will be released after a countdown; the ransom note notes the company still has time to contact the group. Victim is Keysight Technologies; the material is described as encompassing LTE, 5G NR, O-RAN, UE emulation, test-lab management, network-load generation, radio interfaces and related engineering tooling.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Domains
- keysight.com
- Platforms
- LTE 5G NR O-RAN UeSIM gNB eNB AirMosaic
What was taken
The Keysight Technologies data archive includes source code, Git repositories, test platforms, automation systems, firmware, release packages, configurations, diagnostic archives, and engineering materials for LTE, 5G NR, O-RAN, user-equipment emulation, test-lab management, network-load generation, radio interfaces, and chassis systems. The dataset occupies approximately 489 GB on disk in its archived and packaged form. After extraction, the combined unpacked content totals approximately 1.38 TB and contains about 1.05 million files. The files contain LteUuTstm and UeSIM, LTE and 5G NR RRC/NAS, PE WebApp, PATE, pymosaic, pyUee, Hubble/OpenTAP, RuSIM, O-RAN M-Plane, LSU/eLSU, AirMosaic, IxCatapult, XAir, LoadRAN 5G UEE, gNB and eNB Test Manager, LTE/NR Layer 2, baseband, PHY, CPRI/eCPRI, LoadCore, CoreSIM, Gi/UDG/NUDG, IxLoad, IxOS, IxNetwork, Atlas/TMC, firmware, and the software component of the 6 GHz Radio platform. The archive also includes aerospace and satellite engineering materials related to 5G Non-Terrestrial Networks, GEO and multi-satellite scenarios, Ku- and Ka-band configurations, satellite mobility and handover, GNSS integration, RF signal analysis, FR2/OTA captures, and O-RAN radio validation. The files include C, C++, C#, Python, Java, JavaScript, Tcl, TSM, shell, PowerShell, SQL, YANG, ASN.1, XML, JSON, YAML, Make, Autotools, and MSBuild; Windows, Linux, and QNX builds; JAR, WAR, OVA, QCOW2, TAR, TGZ, and firmware packages; test scenarios, configurations, logs, traces, internal documents, and company engineering materials. 1. Technical and Operational Environment The files contain materials related to the development of protocol logic and automation tools, release building and packaging, laboratory testbed configuration, software-package installation, test execution, counter collection, report generation, fault diagnostics, and the preparation of specialized engineering materials for companies. The contents include working source code, Git metadata, build logs, internal release notes, development notes, roadmaps, design and configuration documents, API descriptions, test plans, test cases, Robot Framework jobs, Jenkins configurations, scenario sets, bug reports, packet captures, service logs, and information about installed software versions. The software and deployment materials include Django, Flask, Robot Framework, OpenTAP, Jenkins, Docker, Kubernetes, Helm, NETCONF, REST API, SSH, Wireshark, SymbolShark, and proprietary libraries for controlling UeSIM, gNB, LSU, TSTM, AirMosaic, and network traffic. 2. Main Developments 2.1. LteUuTstm / UeSIM Control Plane v11.1 The archive D:\ixiacom.com\_\Claude-Qing\LTE\Lte_Tm_v11.1.tgz contains the LteUuTstm / UeSIM control-plane v11.1 source repository. It contains 22,936 files, approximately 1.17 GiB of unpacked content, a working tree, Git objects, 7,386 commits in the main repository, 473 remote branches, 2,024 tags, 46 initialized submodules, build scripts, internal documentation, and a build log. The working tree includes 15,152 files. The contents include 2,975 C files, 2,134 C/C++ header files, and C++, Python, Tcl, TSM, ASN.1, shell, Make, and Autotools files. The source/build/schema inventory includes 6,007 files. The repository includes LTE and 5G NR RRC, LTE NAS EMM/ESM, 5G NAS NRMM/NRSM, UE management, SIP/VoLTE, UDG/Gi, IPTG, SIM/AKA, security algorithms, mobility, counters, CLI, TSM runtime, and integration with gNB/eNB/X2. The code contains state machines, RRC and NAS message processing, attach and registration, authentication, security mode, handover, reestablishment, paging, measurements, PDU sessions, QFI, dedicated bearers, SIP REGISTER/INVITE/BYE, RTP, and application-traffic procedures. The LTE and 5G NR RRC code includes setup, reject, reestablishment, release, suspend, resume, security, SIB processing, paging, measurement reporting, handover, radio-link failure, carrier aggregation, NB-IoT, MBMS/eMBMS, UE capabilities, and EN-DC procedures. LT
Ransom note
Published by the group on their leak site, reproduced verbatim.
We are offering one more chance and expect the company to engage in a constructive dialogue; otherwise, all data will be published. File list: https://gofile.io/d/vGbnLvBk We are giving two days to contact us. Contact us Qtox: 99D176DB79C7DB2A708F680C460CA48540230AA103F1EF69A26EBFE29661C933918DE7852521 38,948 38,948 views Sep 1 The files will be published after the timer counts down. The company still has time to get in touch with us
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- label
- File list
- value
- https://gofile.io/d/vGbnLvBk
- File list
- https://gofile.io/d/vGbnLvBk
- latest_post
- Sep 1
- archive_link
- https://gofile.io/d/vGbnLvBk
- File list URL
- https://gofile.io/d/vGbnLvBk
- latest_post_date
- Sep 1
Leak-site images (11)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.