Morgan White Group

This record is a provider-reported ransomware claim attributed to Shiba. It is an allegation and has not been independently confirmed.

Claim context

Provider-reported sector: Finance
Provider-reported country: United States
Group-published claim date: 2026-10-07T10:07:15.292Z
First tracked: 2026-10-07T10:07:15.292Z
Last observed: 2026-10-07T15:34:35.145Z
Monitoring providers: 3
Independent monitoring providers: 3
Post URL: https://cti.fyi/
Data source: unified
Duplicate records merged: 2

Provider observation timeline

Newest observations first. Provider observations are not independent confirmation of an incident.

Monitoring provider: observed 2026-10-07T15:34:35.145Z; source-published 2026-10-07T15:34:35.145Z; retrieved 2026-10-07T13:59:55.969Z.
Monitoring provider: observed 2026-10-07T14:01:30.623Z; source-published 2026-10-29T20:36:15.633Z; retrieved 2026-10-07T13:59:55.969Z.
Monitoring provider: observed 2026-10-07T10:07:15.292Z; source-published 2026-10-07T10:07:15.292Z; retrieved 2026-10-08T00:14:59.781Z.

Provider records

Every stored provider record behind this claim, newest first.

Provider credit
RansomLook
Provider URL
https://www.ransomlook.io/
Feed id
ransomlook
Provider record id
derived-sha256:02fce951374c6ea7c140654ba2f324536e745045aeb71aa80142a09fa6df69e9
MISP event UUID
9d06a8ce-ef31-5aca-b5d4-c985d99bd2a4
Observed
2026-10-07T15:34:35.145Z
Source-published
2026-10-07T15:34:35.145Z
Retrieved
2026-10-07T13:59:55.969Z
Format
json-array
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
cybercrime.works
Provider URL
https://cybercrime.works/leaks/f6c92844-6a2e-4ff5-a5a0-fa8e6844185d
Feed id
cybercrime-works
Provider record id
f6c92844-6a2e-4ff5-a5a0-fa8e6844185d
Observed
2026-10-07T14:01:30.623Z
Source-published
2026-10-29T20:36:15.633Z
Retrieved
2026-10-07T13:59:55.969Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
CTI.FYI
Provider URL
https://cti.fyi/
Feed id
cti-fyi
Provider record id
derived-sha256:39d3aca0e6a7cd2d2e29f1c6978a2d101f4c809e6d3b795114bea579993df11e
Observed
2026-10-07T10:07:15.292Z
Source-published
2026-10-07T10:07:15.292Z
Retrieved
2026-10-08T00:14:59.781Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes

Tracker record history

Newest entries first. These dates describe tracker records, not attack dates.

Provider update: recorded 2026-10-08T00:17:48.762Z; associated provider observation 2026-10-07T10:07:15.292Z.
Provider update: recorded 2026-10-07T14:34:14.147Z; associated provider observation 2026-10-07T14:01:30.623Z.
Provider update: recorded 2026-10-07T14:04:01.654Z; associated provider observation 2026-10-07T14:01:30.623Z.
Initial tracker record: recorded 2026-10-07T14:01:57.148Z; associated provider observation 2026-10-07T15:34:35.145Z.