Whitearmor  (Back to overview)

WhiteArmor is a data-theft and extortion group that appeared in October 2026. It claimed its first victim, Whirlpool, around 21 October 2026, and runs a Tor data leak site plus a clearnet mirror (whitearmor.cc). Within its first week it named 14-19 organisations, mainly in the United States, across the transportation/logistics (J.B. Hunt, Ryder, Echo Global Logistics), retail (Lovesac), consumer electronics (Hisense), online gambling (Gamdom) and political (Partido Liberal, Argentina) sectors. Its most publicised claim is 19 GB of Hisense warranty, customer, supplier and CRM data covering Malaysia and Singapore, for which it demanded USD 5 million in Bitcoin, reportedly raised from USD 500,000. Reports describe an affiliate model with a 5% operator fee and say the group is recruiting pentesters, web exploitation specialists and zero-day researchers. No encryptor has been publicly analysed, and none of the victim claims had been independently confirmed at the time of reporting.

Associated Families

There are currently no families associated with this actor.

References