1. Executive summary
On 2026-09-23 the ransomware group EndZone published a victim listing naming Trump Mobile, a US mobile virtual network operator (MVNO) that operates under a licensed brand from the Trump Organization, and claimed to hold eSIM QR codes and user PII. The verified reference data carries no CVE, no CVSS score and no CISA KEV entry for this item, and it holds no MITRE ATT&CK profile for EndZone, so the attribution to that group is unconfirmed and rests on the leak-site post alone. The listing is single-sourced, publishes no sample, no exfiltration proof and no technical detail, and the victim is a US consumer MVNO with no stated EMEA financial services nexus. Direct exposure for EMEA financial services clients is low unless a client has a commercial relationship with the victim or staff who provisioned lines through it. The material risk is downstream: eSIM activation material and subscriber PII in criminal hands feed SIM-swap and account-takeover fraud against individuals, which is where financial firms should look.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
The victim is a US MVNO, the incident is not the client's own, and the source provides no evidence of an ICT third-party relationship between the victim and any EMEA financial entity. DORA Art. 18 (classification of ICT-related incidents and cyber threats) and DORA Art. 19 (reporting of major ICT-related incidents) attach to the client's own incidents, not to a third party's leak-site listing, and NIS2 Art. 23 (incident reporting obligations) is engaged by incidents affecting the client's own service provision. Mapping any of these here would be a compliance checkbox rather than an obligation.
Two facts would change that assessment. If a client uses Trump Mobile as an ICT third-party provider, DORA Art. 28 (ICT third-party risk, general principles) and DORA Art. 30 (key contractual provisions with ICT third-party providers) become relevant to the contract and exit arrangements, and NIS2 Art. 21(2)(d) (supply chain security measures) applies to the supplier relationship. If a client's own staff or customer accounts were provisioned through the victim and are compromised as a result, DORA Art. 17 (ICT-related incident management process) and Art. 18 come into scope for that client. Neither trigger is established by the source material.
3. Technical analysis & attack chain
Confirmed steps, and nothing beyond them:
- EndZone posted a victim entry for Trump Mobile on its leak site, indexed by ransomware.live on 2026-09-23 at 15:21 UTC.
- The entry records the victim country as US and states a user base of approximately 4,000.
- The entry claims the actor holds eSIM QR codes and user PII belonging to the operator.
That is the full extent of the confirmed record. The source does not state an initial access vector, does not name an exploited component, CVE or vulnerability class, does not identify a malware family, loader, encryptor or exfiltration tool, and does not describe persistence, privilege escalation, command-and-control, lateral movement or the volume and format of any data taken. No ransom demand, negotiation status, deadline or data-publication schedule is given. No sample, screenshot, file listing or proof-of-exfiltration artefact accompanies the claim.
Two data-quality points on the listing itself. The field labelled "Revenue" contains a user count (4K), not a revenue figure, which indicates the entry was populated from a low-detail template rather than from material the actor obtained. The post text is taunting and contains no evidentiary content. Neither point establishes that the claim is false, but neither supports it either.
The claim that eSIM QR codes were taken is the only element with a plausible technical consequence, and the source does not explain how they were obtained or whether they remain valid. In general terms, an eSIM activation QR code encodes a carrier activation credential rather than a subscriber secret, and its usefulness to an attacker depends on whether the profile has already been downloaded and whether the activation token is still redeemable. Adverse Trace has not verified that any code in this claim is live, and clients should not assume either state. Treating the claim as a confirmed compromise of activation material would overstate what the source supports.
Attribution caveat: the verified reference data contains no MITRE ATT&CK profile for EndZone. The group name, its claim of responsibility and its capability set are unconfirmed. This advisory does not attribute the incident to any tracked actor, and the EndZone label should be treated as a leak-site brand until corroborated by a second source.
4. Mitigation & containment
P1, within 24 hours. Establish whether the organisation has any relationship with Trump Mobile: a supplier contract, a corporate mobile plan, a reseller or distribution agreement, or staff who provisioned personal or corporate lines through it. If no relationship exists, record that finding and close the item at this tier. If one exists, treat any eSIM activation QR codes issued through that operator as compromised bearer credentials and reissue them through a different channel, and check for credential reuse where staff used the same email address or password for the operator account and for corporate systems.
P2, within 72 hours. Brief fraud and financial crime teams on the downstream pattern this data supports: SIM-swap and account-takeover attempts against individuals whose subscriber details were exposed, with one-time passcodes delivered by SMS as the target. Where the organisation authenticates customers or staff by SMS one-time passcode, confirm that a fallback factor exists for any account tied to a number provisioned through the victim. Monitor for the claimed data appearing for sale or in follow-on extortion, and set a standing watch on the EndZone leak-site entry for updates.
P3, within 7 days. If a supplier relationship exists, add the entry to the third-party risk register with the current status recorded as unverified, and review the contract's incident notification, audit and termination clauses against your third-party risk framework. Where the operator is an ICT third-party provider supporting a regulated function, the concentration and contractual questions in DORA Art. 29 and Art. 30 apply and should be answered on the facts of that relationship, not on this listing.
No vendor patch, version pin or configuration change applies to this item. There is no exploited component to remediate.
5. Indicators of compromise
No indicators of compromise available in the source material.
The source publishes no hashes, domains, IP addresses, file paths, registry keys, mutexes, scheduled-task names or ransom-note text. The only observable is the leak-site listing itself, which is a public index page and not a malicious artefact. The source describes no authentication, device-registration, process or network behaviour in a victim environment, so no behavioural indicator table is provided.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- ransomware.live, "Victim: Trump Mobile – EndZone", https://www.ransomware.live/id/VHJ1bXAgTW9iaWxlQEVuZFpvbmU=, published 2026-09-23. This is the sole source for the item; the related-source entry supplied with the item resolves to the same URL and is not independent corroboration.
8. Adverse Trace position
Adverse Trace assesses this as a low-severity item for EMEA financial services clients on the evidence available. The claim is single-sourced to a leak-site index, carries no technical detail, no proof of exfiltration and no CVE, CVSS or CISA KEV entry in the verified reference data, and the victim is a US consumer MVNO with no established link to the sector. The attribution to EndZone is unconfirmed because the reference data holds no MITRE ATT&CK profile for that group. We are not raising a client action beyond the P1 relationship check in §4, and we will not treat the eSIM and PII claim as established until a second source corroborates it or the actor publishes material that can be verified. We will monitor the EndZone entry for updates, watch for the claimed data appearing in criminal markets, and reissue this advisory if a client relationship with the victim is identified or if corroborating reporting changes the confidence level. Clients who believe they have exposure to this operator should contact their Adverse Trace analyst directly.
Published via PulseTrace — Adverse Trace threat intelligence.