- Victims · 7d13+5 vs prior week
- Victims · 30d21
- Victims · 90d21
- All-time (tracked)21since 2026-10-21
- Last post10-31 11:25UTC
- Estimated earnings—public reporting
Profile · x-ai/grok-4.7 · updated Summaries by Vani AI
WhiteArmor is not an established ransomware or data-extortion brand in widely cited vendor research, law-enforcement statements, or blockchain-analytics reporting. Dashboard leak-site tracking shows five posts between 2026-10-21 and 2026-10-23, which is too little to confirm a real operation, affiliate model, or victim set. Some tracked labels are site or navigation text rather than organizations, so company names in that feed are not treated as confirmed victims. Origin, tooling, payment activity, and any link to known families are unknown. Defenders should not act on this name until an independent incident report corroborates it.
Tactics & tooling
- Leak-site name-and-shame posting is the only observed behavior, and it is unverified.
- Initial-access vector is unknown.
- Ransomware or exfiltration tooling is unknown.
- Negotiation, payment, and leak-proof practices are unknown.
- No public reporting ties the name to a known ransomware family or affiliate program.
Estimated earnings
No public figure.
Leak-site victims
21 posts · newest first| Victim | Discovered | Details |
|---|---|---|
| Gamdom V2 | · 1d ago | An Insight into Gamdom's Lies We have given Gamdom multiple chances to communicate, to no avail. They didn't even try to see how much data I have on the people, and have already decided that they will not pay the amount. What does this mean? - The 15.4 million entries will be leaked in the same format as below. - The Perabet data (userid | email | password) will also be leaked along with the Gamdom leak. See sample for the format. - All support chats and photos shared in the support chat are in my possession; see the samples below. - The lies within Gamdom's Provably Fair, part 1 is being leaked today, and part 2 when they choose not to pay (with reproducible evidence). A larger data sample of the original breach will also be attached, since some people are doubting the severity of this case. FELIX ROEMER — Founder - Admin uid 16259643 "Felix aka Howly" · last IP 13.250.207.55 (Aug 19) · net +859,966,343 sats - Legacy supadm uid 3356423 - PHONE +49175804570 - Personal player uid 48242366 ("Felix Roemer", duel4rs@gmail.com, same phone) +49175804570 He changed his number 24 hours ago, as a result of this breach. This was his main number prior. PF: What their own code actually shows: 1. The crash game has no player seed. Provably fair normally means you add your own seed and results are computed from your seed plus theirs. In Gamdom's crash game the seed is one fixed constant hardcoded into the game file. It is the same for every player, every round, forever. Nothing about a round depends on you, and the house can know every upcoming result before anyone places a bet. 2. The crash formula carries a hidden house cut. The math in their code includes a term (a divide by 50) that is not part of the fair formula they describe publicly. There is also a built-in 1 in 100 chance that every round instantly crashes at 1.00x. Running their own formula, the real average return to players is about 97.8 percent, and it gets worse depending on where you cash out. 3. The payout rate… |
| KTU Shipyard | · 1d ago | Company: PT Karya Teknik Utama (KTU Shipyard) Location: Batam, Indonesia Founded: 1982 Industry: Shipbuilding & Marine Engineering Website: https://ktushipyard.com/ What the company does KTU Shipyard is an Indonesian shipbuilding company specializing in the construction, repair and maintenance of commercial vessels. Its main products and services include: - Tugboats - Barges - Tankers and cargo vessels - Crane barges - Ship repair and maintenance Company size - Privately owned company. - Approximately 501–1,000 employees. - Multiple shipyard facilities in Indonesia. - Claims to have built approximately 2,200 vessels. Annual Revenue ~USD 200 million Key Business Information - Business model: B2B shipbuilding and marine services. - Customers: Shipping companies, marine logistics operators and offshore businesses. - Main market: Indonesia and regional maritime markets. - Competitive advantage: Established shipbuilding experience, multiple facilities and diverse vessel manufacturing capabilities. What was accessed: Internal ticketing systems, All users drive (including business, customer, confidential files over 3tb of data), customer data, etc. You have 20 days to reach out or let it be your downfall. Attatched: Is a sample file from recent user drives, and a screenshot showing POA (proof of access) We can be very reasonable and this can go well or it can not. You can start contact at the email: whitearmormember@proton.me https://gofile.io/d/G981x5Rl https://gofile.io/d/99sTtibR (backup sample files) |
| rolly.io | · 3d ago | Rolly.io is an on-chain crypto casino on Arbitrum featuring a public bankroll, transparent bonus formulas (rakeback, weekly bonuses), and active player reward systems. We hold 1,364 rolly.gg player PII records with linked on-chain wallets, 430K+ ledger transactions, 11,442 wallet addresses, 155 whale payout maps, 299 deanonymized staff/CTO emails, and 313 internal chat messages. We aren't asking for any ransom, we just thought it was funny to hack a casino that made a joke about Gamdom. |
| Ryder | · 4d ago | Ryder is a Fortune 500 transportation and supply chain management company providing fleet management, dedicated transportation, and logistics solutions. What we hold: 18.75M rows, 328 CSVs, consumer names, phones, emails, driver/associate PII, cleartext API keys, LMS credentials, FTP/telematics configs from RyderView, RLM, EFT. Our demand is only $20M in BTC... i swear. Samples can be found below. Emails with instructions will be sent to Ryder shortly, and no we did not buy access from 'shadowbyte' or whatever the niggas name is on pwnforums. Contact if you do not receive the instructions: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: whitearmorrxd@proton.me |
| wagyu.xyz unfairness | · 4d ago | wagyu.xyz runs two rigged systems, both proven by the evidence: 1. Rigged coinflip. The site advertises "48% win chance, 4% house edge" (coinflip-public-claim.txt, coinflip-public-terms.json), but server settings aimed for a 4.00% expected edge and the distribution of outcomes is measurably shifted against players: of 2,852 provably-fair-verified flips, 1,417 fell in the 0-48000 band versus 1,325 above 52000, with only 110 in the dead zone (coinflip-measured-odds.json, result_bins). The provably-fair HMAC checks all pass (coinflip-fairness-verify.py, coinflip-sample-seed-chain.json), which only proves the commits weren't tampered per-round; the win thresholds themselves are crooked. Internal accounting confirms: expectedEdge "4.00", actualEdge "2.92" against a published 2% edge, and a 36.49% player win rate (coinflip-house-stats.json, coinflip-settings.json, coinflip-accepted-orders.json). 2. Hidden fee overcharging. Across 28,840 swap/bridge orders totaling ~$264.9M notional, wagyu advertised $1.73M in fees but actually collected $5.64M, hiding $3.9M or 69.28% of its real take (fee-overcharge-metrics.json). 13,190 orders were charged above the quoted rate, 1,812 above 2 percentage points. The server's internal policy charges up to 10% where the public disclosure says 2% (fee-policy-server.json vs fee-public-disclosure.txt, fee-policy-feeds.json, fee-overcharge-summary.json). Worst cases are itemized in fee-top100-overcharged.csv, e.g. order RMNCMB: $3.17M swap, quoted 0.02, charged 0.08, $190,092 stolen (fee-order-RMNCMB.json). Evidence to support this can be found below: |
| Echo.com | · 4d ago | Echo Global Logistics is a Chicago-based, technology-enabled third-party logistics provider offering freight brokerage and integrated supply chain services, including truckload, LTL, warehousing, and cross-border shipping across North America. We hold Echo Global Logistics data: 2.06M claims rows, 153,727 freight loads, 261,440 quotes ($705M buy volume), 136,273 tenderings, 59,607 tracking records, 3,890 employee identity mappings with emails, 2,418 customers, 9,122 carriers, and warehouse geodata. We suggest you pay a small ransom demand of $10,000,000 in BTC and move on with your lives. Emails with instructions will be sent to you shortly. Samples can be found below. Contact: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: whitearmorrxd@proton.me |
| https://t.me/whitearmorxd | · 4d ago | Hi, join our telegram channel for fun.. i guess https://t.me/whitearmorxd |
| Kucoin | · 5d ago | Dear Kucoin, We are NOT a hacktivist group. We focus mainly on data extortion & ransomware, so please fuck off with your hacktivist bullshit. https://www.kucoin.com/news/flash/hacktivist-group-whitearmor-claims-to-steal-15-42-million-gamdom-accounts-demands-15m-in-bitcoin |
| wagyu.xyz | · 5d ago | Wagyu.xyz is a cross-chain swap platform that allows users to exchange cryptocurrencies for native Monero (XMR) without requiring identity verification (KYC) . It routes orders through Hyperliquid's order book for execution . We hold 38,628 orders and 10,139 IPs from wagyu.xyz: wallets, sessions, fingerprints, countries, $907M XMR-heavy volume. Our demand is only $5,000,000... hehe Samples can be found below. Since you do not have any emails for us to contact, surely you will contact us yourselves. Contact Us: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: whitearmorrxd@proton.me |
| gamblinglore | · 5d ago | Verification for Gamblinglore.com |
| Gamdom | · 6d ago | Gamdom is an unregulated crypto casino and sportsbook founded in 2016. It recently suffered a hot-wallet breach, with founder Felix Romer reporting over $3 million in losses, though on-chain analysts estimate the damage closer to $4.2 million. We hold Gamdom's full user database, 15,420,003 accounts with 146 columns, with Gamdom's total combined profit value exceeding $1 billion. The way in was something internal, a machine account that was already sitting in their admin side (Metawin). Issued years back, nobody ever rotated it. Never meant to leave the building. It had admin reach, and everything after that was their own stuff anyway, their control panels and secret stores. About your provably fair: what it promised and what it delivered were never the same thing. We demand $15,000,000 in BTC. Emails with instructions will be sent to you directly. To verify, a sample can be found below. |
| LoveSac | · 6d ago | LoveSac (LOVE) is a premium furniture retailer operating more than 250 showrooms across the United States, generating approximately $700 million in annual revenue. We have obtained a database containing 1,113,285 order records spanning nearly seven years of transactions, from December 2019 through October 2026, with a combined recorded transaction value exceeding $1.62 billion. Each record contains detailed customer and transaction information, including full customer names, complete billing and shipping addresses, telephone numbers, order numbers, order dates, order statuses, and order grand totals. Our demand: $500,000 in BTC or XMR To verify, samples can be found below. |
| J.B Hunt | · 6d ago | You are so stupid JB Hunt. Instead of getting in contact with us & starting the negotiation process, not only did you not announce the breach, you silently email customers demanding them to update their passwords.. Fuck you... ;/ |
| https://x.com/WhiteArmorxd | · 7d ago | Hi, we now have an X account. https://x.com/WhiteArmorxd Also, fuck the AI slop cti reporters lol |
| Partido Liberal | · 7d ago | Brazil's Liberal Party (PL) is the political party of the Bolsonaro family. Although named "Liberal," it is currently characterized by conservatism and right-wing populism. Jair Bolsonaro joined the party in 2021, and his son Flávio Bolsonaro is now the party's presidential candidate, advocating reduced government intervention and tough security policies. We hold the complete Partido Liberal (PL, Brazil) dump: 79K member records with CPF/voter ID/RG photos, 374 live cleartext e-Título credentials, 475 operator accounts with shared password, 2.7M audit events, party dossiers (artist payments, deepfakes, ghost donations), vendor PII, and 340K+ member images. If you don't want this getting out, we suggest you contact us & pay the ransom amount of $5,000,000 in BTC :) Contact: Email: whitearmorrxd@proton.me Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 |
| Hisense | · 7d ago | Hisense is a Chinese multinational electronics and appliance manufacturer, founded in 1969, known globally for televisions and home appliances. We hold Hisense's entire GCRM production document store, the full warranty-claims archive for Malaysia/Singapore: customer names, phones, emails, ID numbers, 2,549 suppliers, hundreds of invoices, payments, contracts, RMA forms, claim evidence, plus their internal CRM app binary. Our demand is $500,000 in BTC. Good luck. Contact: whitearmorrxd@proton.me Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 |
| whitearmor.cc | · 8d ago | Hi, our VPS provider has decided to ban our account. Due to this, whitearmor.cc is down and so is most of the data posted on our DLS. Everything will be back up within a day or two. One tip, do NOT use https://stealthvm.net/ XD |
| JB Hunt | · 9d ago | J.B. Hunt is a major North American transportation and logistics company providing intermodal, dedicated, and truckload services via its digital freight marketplace. We hold 140,838 employee records with PII and national IDs, 1.7M carrier contacts, 38.2M invoices, 187K RBAC permission records, 3,196 ranked account-takeover targets, 973 M365 mailboxes, 374K organizations. Our demand: $5,000,000, in BTC or XMR. Instructions to follow by email. To verify, samples can be found below. Contact: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: whitearmorrxd@proton.me |
| Whirlpool | · 10d ago | Whirlpool is a global home appliance manufacturer (NYSE: WHR) making washers, fridges, and cooking appliances under brands like KitchenAid and Maytag. Its 2025 annual revenue was about $15.52 billion. We hold 4,577 Whirlpool employee records across three plants, names, AD-style usernames, managers, cost centers, shifts, along with 374 corporate emails, ~22,000 SAP invoice records, and the full plant contact infrastructure. Pay, and this stays quiet. Don't, and the data goes public. We want $140,000 in BTC or XMR. You will receive an email containing instructions on how to proceed. Samples: https://biteblob.com/Information/mNTP6w0lBW8P9l/#samples.zip Contact: whitearmorrxd@proton.me Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 |
| W.A | · 11d ago | Hello, We are WhiteArmor, an organization focused on data-theft extortion, with further motive to expand in to ransomware operations when considered big enough. We are currently seeking the following people of roles and experiences: Penetration testers Web-exploitation Zero-day research A word due; if you are unfamiliar with the experiences slash roles listed above, do not consider attempting to join. Should you attempt to contact us and join, you will be blocked. Our fee if you hit a successful ransom payout is 5%. The rest is yours. Our contacts are available on our DLS below; http://whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion/ |
| Updates. | · 11d ago | Hi all; spots within the group are still open. If you're looking to join, you can find our contact information at the top right. Our ransomware is nearly complete, and we have multiple companies lined up to list, including Fortune 500 companies and multi-billion-dollar revenue firms. To be clear, we're not just some random skid group. We are releasing Disney's Staff Directory as a little start to our group, though more to come. Anyways, enjoy. This data is unrelated to the NullBulge leak; it was exfiltrated via a JWT authentication bypass vulnerability in the gateway. |
In the news
AllVictim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .