1. Executive summary
On 2026-08-17, the actor "bravox" publicly named UK company Moores (www.moores.co.uk) as a ransomware victim on its leak site. Moores is a kitchen solutions provider for housing developers. The actor "bravox" has no MITRE ATT&CK profile in the verified reference data; attribution is therefore unconfirmed. The listing is single-sourced via ransomware.live, which indexes publicly visible posts by ransomware operators. No technical detail on initial access, malware, or exploitation is available in the source material. EMEA financial services clients should treat this as a third-party / supply-chain exposure event if Moores is a vendor or sub-contractor.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk — general principles | Moores is a UK supplier to housing developers; if a client depends on Moores as an ICT third-party provider, the public ransomware claim is a third-party risk trigger. | Clients with Moores in their ICT supplier chain must assess whether the claimed compromise affects their own ICT services and escalate through their third-party risk process. |
| NIS2 Art. 21(2)(d): supply chain security measures | A named supplier (Moores) has been publicly claimed compromised by ransomware, potentially affecting supply chain security. | NIS2 in-scope entities should review whether Moores appears in their supplier inventory and whether the incident affects their supply chain security posture. |
No specific DORA incident-reporting article (Art. 19) is engaged at this stage because there is no confirmed impact on a client's own ICT services — only a public claim against a third party.
3. Technical analysis & attack chain
No technical attack-chain detail is available in the source material. The ransomware.live listing provides only the victim name, country (GB), website (www.moores.co.uk), and a sector description. No CVE, initial access vector, malware family, persistence mechanism, C2 infrastructure, or lateral movement detail is described.
Single-sourced; verify before enforcement. The entire claim rests on a single source: the ransomware.live indexing platform, which aggregates posts from ransomware operator leak sites. The platform itself states it does not access or obtain stolen data and indexes only publicly visible information. No corroborating statement from Moores, law enforcement, or a second vendor report is present in the provided material.
Attribution caveat. The actor "bravox" has no MITRE ATT&CK profile in the verified reference data. Treat the group name and all attribution as unconfirmed.
Supplementary data from source. The ransomware.live record references Hudson Rock infostealer intelligence for the victim domain, reporting: 0 compromised employees, 6 compromised users, 0 third-party employee credentials, and 3 external attack-surface entries. These figures are presented as context by the platform and are not independently corroborated. They do not confirm the ransomware claim but may indicate prior credential exposure worth reviewing.
4. Mitigation & containment
P1 — within 24h
- Identify whether Moores (www.moores.co.uk) appears in your ICT third-party supplier register, procurement system, or vendor risk database. If yes, flag the relationship for immediate review.
- If Moores provides any ICT service, software, or managed component to your environment, assess whether a compromise of Moores could affect your ICT availability, integrity, or confidentiality. Suspend non-essential data exchange if exposure is plausible.
P2 — within 72h
- Contact Moores through established vendor-management channels to seek confirmation or denial of the incident and any impact on services your organisation consumes.
- Review the Hudson Rock–sourced context (6 compromised users, 3 external attack-surface entries) if accessible; determine whether any credentials relate to accounts that touch your environment.
- If Moores holds or processes your data, invoke contractual breach-notification provisions (DORA Art. 30: key contractual provisions with ICT third-party providers) and require written confirmation of the incident status.
P3 — within 7 days
- Update the third-party risk register entry for Moores to reflect the public claim and any response received.
- If Moores is confirmed compromised, conduct a retrospective review of all data flows, integrations, and access granted to Moores in the preceding 90 days.
- Monitor for any follow-on claims or data publications by "bravox" on leak-site monitoring feeds.
5. Indicators of compromise
No indicators of compromise available in the source material.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Public leak-site listing by "bravox" naming Moores as victim | Ransomware leak-site monitoring feeds / ransomware.live | Low — single-sourced, unconfirmed |
| 6 compromised users associated with victim domain (Hudson Rock context) | Infostealer intelligence platforms | Low — context only, does not confirm ransomware |
| 3 external attack-surface entries for victim domain | Attack-surface management tools | Low — context only |
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- Ransomware.live — "Victim: Moores – bravox" — https://www.ransomware.live/id/TW9vcmVzQGJyYXZveA== — 2026-08-17
8. Adverse Trace position
This is a low-confidence, single-sourced public ransomware claim with no technical detail and an unconfirmed actor attribution. The primary risk to EMEA financial services clients is supply-chain exposure if Moores is an ICT third-party provider or data processor. We assess the immediate operational impact as low for most clients but recommend immediate supplier-inventory checks. We will monitor for corroborating reporting, statements from Moores, or additional technical detail from a second source before upgrading severity. If Moores is confirmed as a client supplier, we will issue a follow-up with specific containment guidance.
Published via PulseTrace — Adverse Trace threat intelligence.