Whitearmor

WhiteArmor is a financially motivated data-theft and extortion group first publicly observed claiming victims in late October 2026. It operates a data-leak site and demands cryptocurrency payments under threats to publish allegedly stolen information. By November 11, 2026, it had listed roughly 20 organizations, with transportation and logistics companies accounting for a substantial share of its claimed targets. Listed organizations include Maersk, J.B. Hunt, Ryder, Echo Global Logistics, Hisense, Whirlpool, and Unilever. Its targeting also extends to healthcare, shipbuilding, online gambling, and cryptocurrency services. WhiteArmor uses public victim listings, payment deadlines, and purported data samples to pressure organizations. Its published demands have ranged from approximately $140,000 to $20 million. The group emphasizes alleged possession of employee and customer information, business documents, and transaction records. Although frequently labeled a ransomware group, its documented public activity centers on data-theft extortion; file encryption and deployment of a specific ransomware family have not been established. Some listed organizations have acknowledged unauthorized access, but these disclosures do not independently establish WhiteArmor's responsibility or validate its claimed data volumes. Its geographic origin, initial-access methods, and technical tooling remain unknown.