Ransomware: lamashtu named Becker Logistik (DE)

1. Executive summary

A ransomware group tracked as "lamashtu" listed Becker Logistik, a German road-freight and bulk-goods haulier, on its public leak site on 2026-09-30. The listing is a claim of compromise, not evidence of one: no sample, no initial-access vector, no exfiltration proof and no ransom demand have been published, and the group has no MITRE ATT&CK profile, so the attribution and the intrusion itself are unconfirmed. The direct risk to EMEA financial services is second-order and specific: Becker Logistik is a freight counterparty, and banks, trade-finance desks, insurers and leasing books that carry this haulier as a supplier or obligor should treat its invoicing, remittance and proof-of-delivery channels as potentially compromised until the claim is resolved. No CVE, no CVSS score and no CISA KEV entry apply to this item; there is no patchable vulnerability in scope.

2. Regulatory framing

No DORA Art. 17, 18, 19, 24 or 29 trigger and no NIS2 Art. 23 or UK NIS 2018 trigger is engaged on the facts available: there is no confirmed incident at a client, no confirmed major-incident classification, and no confirmed disruption to a client's own service. If a client's own systems are later found to be affected, Art. 17 to 19 and NIS2 Art. 23 come into play at that point.

3. Technical analysis & attack chain

No attack chain can be reconstructed from the available material. The only confirmed facts are the leak-site listing itself.

1. On 2026-09-30 at 13:06 UTC, the group "lamashtu" posted a victim entry naming Becker Logistik, country DE, website becker-logistik.de, on its public leak site.
2. The entry carries a company description (German logistics and transportation, national and international freight, bulk goods, own fleet) and a leak screenshot placeholder.
3. No initial-access vector, exploited component, CVE, malware family, payload, persistence mechanism, command-and-control channel, lateral-movement path, exfiltration volume or ransom figure is stated anywhere in the source.

The listing is hosted on ransomware.live, an indexer that republishes operator-posted material. The indexer's own disclaimer states it does not acquire, download, host or redistribute the underlying stolen data and indexes only publicly visible operator posts. That means the advisory rests on a single source: the operator's own claim, relayed by one indexer. Nothing in the material independently corroborates that Becker Logistik's systems were accessed, that data was taken, or that any demand was made. Treat the compromise as alleged, not established.

Attribution is unconfirmed. "lamashtu" has no MITRE ATT&CK profile in the verified reference data, so there is no tracked tooling, infrastructure or victimology to map against. The name may be a new or rebranded operation, a low-volume extortion crew, or a label reused by an unrelated actor. Do not build detection or blocking logic on the group name.

The sector relevance is the freight and bulk-goods profile. A haulier of this type holds customer manifests, delivery addresses, customs and consignment paperwork, bank details for remittance, and driver and subcontractor records. If the claim is genuine and data was taken, the exposure for a financial-services counterparty is business-email-compromise style fraud against payment instructions and invoice reconciliation, not a technical intrusion into the bank's own estate. That is a hypothesis drawn from the victim's business type, not a finding from the source, and it should be treated as such.

4. Mitigation & containment

P1 (within 24 hours)

• Confirm whether Becker Logistik is an active supplier, obligor, insured party or freight counterparty anywhere in the group. If it is, suspend automated payment release against new or changed remittance instructions from this counterparty until the claim is resolved.
• Call the counterparty on a number already held on file, not one supplied in a recent email, and ask directly whether they have an incident, whether their invoicing or banking details have changed, and who is authorised to instruct payments.
• Freeze any pending change-of-bank-details request attributed to this supplier and route it to out-of-band verification.
• If the counterparty confirms an incident, open an internal record against DORA Art. 28 third-party tracking and check the contract's incident-notification clause (Art. 30).

P2 (within 72 hours)

• Review the last 90 days of invoices, remittances and proof-of-delivery documents from this counterparty for anomalies: altered account numbers, mismatched letterheads, changed contact addresses, unusual urgency.
• Check trade-finance, invoice-discounting and supply-chain-finance exposures where this haulier appears as obligor or as the transport leg of a financed shipment.
• Ask the counterparty, if contactable, which systems were affected and whether customer or payment data was in scope. Record the answer; do not accept a denial without a named contact.

P3 (within 7 days)

• Add the counterparty to the third-party register with the incident noted, and record whether the contract obliged them to notify.
• If the group name "lamashtu" appears in any threat-intel feed with infrastructure or tooling, treat that as unverified until a second source corroborates it. Do not add blocklists on the strength of the leak-site listing alone.
• Re-test the out-of-band callback procedure for supplier payment changes across the vendor base, not only this counterparty.

No vendor fix, patch or version pin applies. There is no CVE in this item.

5. Indicators of compromise

No indicators of compromise available in the source material.

The only atomic values in the source are the victim's own domain and website (becker-logistik[.]de), which are the victim's legitimate identifiers, not attacker infrastructure, and are therefore not listed as IOCs. No attacker domain, IP, hash, file path, registry key or email address is present in the source. No copyable block is provided because there is nothing machine-pivotable to put in it.

Behavioural indicators, if the claim is later confirmed, would be observable in the counterparty's environment rather than the client's. The source does not describe any, so none are listed.

6. Detection

Insufficient indicators to author detection rules.

The source contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text or hard-coded values. The group name and the victim name are not threat artefacts and a rule built on them would detect reporting about the incident rather than the incident. No YARA or Sigma rule is emitted.

7. Sources

• ransomware.live, "Victim: Becker Logistik – lamashtu", https://www.ransomware.live/id/QmVja2VyIExvZ2lzdGlrQGxhbWFzaHR1, published 2026-09-30. Single source; operator claim relayed by an indexer, not independently corroborated.

8. Adverse Trace position

We assess this as a low-confidence, single-sourced extortion claim with no technical detail, no confirmed intrusion and no confirmed data theft. There is no CVE, no CVSS score and no CISA KEV entry to prioritise, and the group has no MITRE ATT&CK profile, so we do not attribute the activity to any tracked actor. The client impact is confined to counterparty and payment risk for institutions that transact with this haulier; it is not a threat to internal infrastructure. We will monitor for a second source confirming the compromise, for any published sample or exfiltration proof, and for the group name appearing with infrastructure or tooling in vendor reporting, and we will reissue if any of that materialises. Clients with an active exposure to Becker Logistik should tell their Adverse Trace contact so we can track the counterparty specifically.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.