> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Ransomware: lamashtu named Bender Tribunenbau (DE)
- URL: https://f4n6.co.uk/security-feed/ransomware-lamashtu-named-bender-tribunenbau-de/
- Published: 2026-10-05T20:39:49.000Z
- Updated: 2026-10-05T20:39:49.000Z
- Author: Jeff Davies
- Tags: #security-feed, Lamashtu

## 1\. Executive summary

A ransomware group operating under the name "lamashtu" listed Bender Tribunenbau, a German manufacturer of mobile and permanent grandstands, stages and temporary event structures, on its public leak site on 2026-10-05\. The listing names the victim, the country (DE) and the victim domain bender-tribuenen.de, and carries a leak screenshot. The only substantive claim is the listing itself: no initial access vector, no exploited CVE, no malware family and no data sample are present in the source material, and the group has no MITRE ATT&CK profile, so the attribution and the intrusion mechanics are unconfirmed. For EMEA financial services the direct exposure is limited unless Bender Tribunenbau sits in a supplier, event-sponsorship or facilities chain, but the listing is a reminder that German mid-market manufacturers with thin security functions are being named and that any downstream contractual or payment relationship inherits the disclosure risk. No CVSS score, severity rating or CISA KEV exploitation state applies to this item because no CVE is identified.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item on the facts available. The source contains a leak-site listing and a victim name only; it does not establish that an ICT-related incident occurred at a financial entity, that a third-party ICT provider relationship exists, or that any reporting threshold was crossed. Mapping DORA Art. 19 or NIS2 Art. 23 here would require facts the source does not supply.

| Article | Trigger (the fact in this item)                        | Practical impact |
| ------- | ------------------------------------------------------ | ---------------- |
| n/a     | No trigger in this item meets the distinctiveness test | n/a              |

If a client holds Bender Tribunenbau as a supplier or event-services counterparty, the relevant question is contractual rather than regulatory: whether the relationship is in scope of DORA Art. 28 or Art. 30 depends on whether the entity provides ICT services, which the source does not state. Treat that as an internal determination, not a conclusion from this advisory.

## 3\. Technical analysis & attack chain

The source material does not support an attack chain. What is confirmed is a single event:

1. On 2026-10-05 at 07:31:53 UTC, the group "lamashtu" published a victim entry naming Bender Tribunenbau, country DE, domain bender-tribuenen.de.
2. The entry includes a leak screenshot and DNS records for the victim domain, both rendered by the indexing platform rather than by the operator.

Nothing beyond step 2 is stated. There is no initial access vector, no exploited component or CVE, no payload or malware family, no persistence mechanism, no privilege escalation path, no command-and-control infrastructure, no lateral movement description, no exfiltration evidence and no stated impact such as encryption or data publication. The source does not say whether data was stolen, whether a ransom was demanded, or whether the listing is a negotiation tactic rather than a completed intrusion.

Two caveats matter for how this is handled. First, the listing is single-sourced to the ransomware.live index, which republishes operator claims without verifying them; a leak-site entry is an assertion by the operator, not evidence of intrusion, and some listings are recycled, exaggerated or fabricated. Second, "lamashtu" has no MITRE ATT&CK profile in the verified reference data, so no TTP set, tooling or victimology can be attributed to it. Any statement that this group uses a particular ransomware family, initial access broker or double-extortion model would be invention. Clients should treat the group name as a label on a leak-site post and nothing more until a second source corroborates it.

The victim profile is the one usable analytic point. Bender Tribunenbau builds and rents grandstands, stages, podiums and temporary structures for stadiums, festivals and concerts. That is a project-based manufacturer with seasonal peaks, subcontractor chains and event-site logistics, which is the profile that tends to carry remote access for site surveys, CAD and ERP systems shared with partners, and thin out-of-hours monitoring. None of that is confirmed for this victim; it is the reason the listing is worth a supplier check rather than a dismissal.

## 4\. Mitigation & containment

There is no vendor fix to apply and no CVE to patch, because no vulnerability is identified in this item. The actions below are supplier-risk and readiness actions, not incident response to a known intrusion.

P1 (within 24h)

- Determine whether Bender Tribunenbau appears in your supplier, vendor, sponsorship, events or facilities register, and whether any live contract, purchase order or payment run touches bender-tribuenen.de. If it does, contact the counterparty through a channel you already hold, not through contact details from the leak site, and ask directly whether they have an incident. Do not reference the listing in the first contact if the relationship is commercially sensitive.
- If you have an active payment or invoice flow to this entity, place a manual verification hold on any change-of-bank-details request referencing this supplier. Business email compromise and invoice fraud frequently follow a leak-site listing, whether or not the underlying intrusion is real.
- Check mail gateway and DNS logs for inbound mail from bender-tribuenen.de in the last 30 days and for any lookalike domain registered against that name. A listing is often followed by impersonation of the victim.

P2 (within 72h)

- If the counterparty confirms an incident, request their incident timeline and ask whether any of your data, credentials or shared system access was in scope. Do not accept a verbal assurance; ask for the scope statement in writing.
- Review any shared access you granted to this supplier: VPN accounts, file-share or SharePoint guest accounts, EDI or API credentials, and any service account used for joint project work. Disable or rotate anything not needed for current work, and rotate credentials for anything that is.
- Confirm your own ransomware playbook covers a supplier-side listing with no technical detail. The failure mode here is over-reaction to an unverified post; the control is a documented triage step that separates "listed" from "confirmed compromised".

P3 (within 7 days)

- Add the supplier to your third-party watch process and re-check the listing in 7 and 30 days to see whether a data sample, count or deadline appears. Operator posts often gain detail after the initial entry.
- If the entity is in scope as an ICT third-party provider under your own DORA Art. 28 register, record the listing as a risk event and note the source is unverified. Do not escalate it as a major incident on this evidence alone.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The source contains no hashes, no file paths, no registry keys, no command lines, no mutexes, no ransom-note text and no network infrastructure beyond the victim's own domain, which is a legitimate business domain and is not an indicator.

The only observable in the source is the leak-site listing itself. It is recorded below as a behavioural indicator for tracking purposes, not as a machine-pivotable atomic indicator, and it does not go in the copyable block.

### Behavioural indicators

| behaviour                                                                                                            | where to observe                                                         | confidence                                                |
| -------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ | --------------------------------------------------------- |
| Public leak-site entry naming Bender Tribunenbau (DE), domain bender-tribuenen.de, published 2026-10-05 07:31:53 UTC | ransomware.live index and any leak-site monitoring feed you subscribe to | medium (listing observed; intrusion unconfirmed)          |
| Inbound mail or payment-change requests referencing bender-tribuenen.de following the listing                        | mail gateway logs, AP queue, supplier master data change log             | low (no such activity reported; included as a watch item) |

## 6\. Detection

Insufficient indicators to author detection rules. The source provides no threat artefacts (no strings, command lines, filenames, registry keys, mutexes or ransom-note text) from which a YARA or Sigma rule could be built. A rule keyed on the victim domain or the group name would detect reporting about the event, not the threat, and is not emitted.

## 7\. Sources

- ransomware.live, "Victim: Bender Tribunenbau – lamashtu", https://www.ransomware.live/id/QmVuZGVyIFRyaWJ1bmVuYmF1QGxhbWFzaHR1, published 2026-10-05\. Single source; operator claim republished by an index, not independently verified.

## 8\. Adverse Trace position

We assess this as a low-confidence, low-severity item for EMEA financial services. The only verified fact is that a leak-site entry exists; the intrusion, the data theft and the group's capability are all unconfirmed, and "lamashtu" has no MITRE ATT&CK profile, so we make no attribution claim and assign no CVSS score or KEV status because no CVE is in scope. Client impact is limited to those with a direct supplier, sponsorship or payment relationship to Bender Tribunenbau, and for those the near-term risk is follow-on invoice or impersonation fraud rather than technical compromise of the client. We will re-check the listing at 7 and 30 days for a data sample, victim count or deadline, and we will issue an update if a second independent source corroborates an intrusion or if the group is linked to a known ransomware family. Clients who hold this entity as a supplier should tell us so we can track it against their third-party register.

---

[Read the original source →](https://www.ransomware.live/id/QmVuZGVyIFRyaWJ1bmVuYmF1QGxhbWFzaHR1?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*