> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Ransomware: lamashtu named GERLON (DE) - URL: https://f4n6.co.uk/security-feed/ransomware-lamashtu-named-gerlon-de/ - Published: 2026-09-30T22:06:11.000Z - Updated: 2026-09-30T22:06:11.000Z - Author: Jeff Davies - Tags: #security-feed, Lamashtu ## 1\. Executive summary A ransomware group tracked as "lamashtu" listed GERLON, a French steel wool, brush, abrasive and tooling manufacturer based in Abbeville (Somme), on its leak site on 2026-09-30\. The listing names the victim, gives the country as DE and the domain as gerlon.com, and carries a leak screenshot; the source provides no initial access vector, no malware family, no CVE and no victim statement. There is no MITRE ATT&CK profile for "lamashtu" in the verified reference data, so the attribution is unconfirmed and the group's tradecraft cannot be characterised from this item. EMEA financial services exposure is indirect: GERLON is an industrial supplier, not a financial entity, so the risk to clients is third-party and supply-chain, not direct compromise. No CVE, CVSS score or CISA KEV entry applies to this item. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk, general principles | A named supplier (GERLON) in a client's vendor or procurement chain is listed on a ransomware leak site, and the source gives no confirmation of what data was taken or whether the listing is genuine | Clients that buy from or integrate with GERLON should treat this as a third-party ICT risk event and request confirmation from the supplier before relying on any continuity assumption | | NIS2 Art. 21(2)(d): supply chain security measures | The only fact available is a leak-site listing naming a supplier; there is no technical detail to assess | Entities in scope should apply their supplier security measures to this vendor relationship, but the absence of technical detail means no specific control can be mandated from this item alone | No DORA incident-reporting article (Art. 17, 18, 19) is engaged on the facts available: there is no confirmed incident at a client, no confirmed data breach, and no confirmed service disruption. No UK NIS 2018 duty is engaged, as the victim is an EU industrial supplier with no stated UK nexus. ## 3\. Technical analysis & attack chain The source material does not support an attack chain. What is confirmed is limited to the listing itself: 1. On 2026-09-30, the group "lamashtu" posted GERLON to its leak site. 2. The listing records the victim name (GERLON), country (DE) and domain (gerlon.com). 3. A leak screenshot is referenced by the indexing platform. No initial access vector, exploited component, CVE, payload, malware family, persistence mechanism, privilege escalation path, command-and-control infrastructure, lateral movement, exfiltration method or impact statement is present in the source. The indexing platform's own disclaimer states it does not acquire, download, host or redistribute the underlying stolen data, so the screenshot is not evidence of what was taken. Two discrepancies are worth flagging. First, the listing gives the country as DE, while the victim description places GERLON in Abbeville, France (SAS, SIREN 349008284). The country field in leak-site listings is frequently wrong or refers to a subsidiary, so the DE tag should not be treated as reliable. Second, the domain given is gerlon.com; the source does not confirm that this domain belongs to the French manufacturer described, and no DNS records are reproduced in the material provided beyond a heading. Attribution caveat: "lamashtu" has no MITRE ATT&CK profile in the verified reference data. The group name is a self-assigned label on a leak site and is not corroborated by any independent source in this item. Treat the actor identity, motivation and capability as unconfirmed. This is a single-source item (the ransomware.live listing); verify before acting on it. ## 4\. Mitigation & containment P1 (within 24h) - If GERLON is a direct supplier or a supplier to a client, contact the supplier through a known-good channel (not an address taken from the listing) to establish whether the listing is genuine and whether any client data is involved. Do not act on the leak-site claim alone. - Check whether gerlon.com appears in outbound proxy, email gateway or DNS logs for the last 90 days. If it does, review those sessions for data transfer or credential use. - Search endpoint and email telemetry for any file, attachment or link referencing gerlon.com or the lamashtu leak site, and block the leak-site domain at the web proxy and DNS resolver. P2 (within 72h) - Where GERLON sits in a procurement or ERP integration path, confirm with the business owner what data and systems the relationship touches, and whether any credentials, API keys or shared file paths are in scope. - Review supplier contracts for breach-notification and audit clauses. DORA Art. 30 key contractual provisions apply where the supplier is an ICT third-party provider under a DORA-scoped contract; if the contract lacks a notification clause, raise it with procurement. - If any client credentials were shared with GERLON, rotate them and check for reuse. P3 (within 7 days) - Add gerlon.com and the lamashtu leak-site domain to the supplier-risk register with the listing date and the unconfirmed status. - If the supplier confirms a breach affecting client data, escalate to the incident-management process and assess DORA Art. 18 classification and Art. 19 reporting against the confirmed facts, not the listing. No vendor fix, patch or version pin applies. There is no CVE in this item. ## 5\. Indicators of compromise The source provides no atomic indicators: no hashes, no IP addresses, no malware filenames, no registry keys, no command lines. The only network-identifiable value is the victim's own domain, which is not a malicious indicator and is not reproduced here as one. The leak-site listing URL is a reference, not an IOC. No indicators of compromise available in the source material. Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------ | ---------------------------------------------- | ------------------------------------------------------------------------------------------- | | Outbound connections or email to gerlon.com from corporate systems | Web proxy, DNS resolver, email gateway logs | Low; the domain is the victim's, not the actor's, and no traffic is confirmed in the source | | Access to the lamashtu leak-site domain from corporate endpoints | Web proxy, DNS resolver, EDR network telemetry | Low; no domain value is given in the source beyond the indexing platform URL | ## 6\. Detection Insufficient indicators to author detection rules. The source contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file paths, registry keys, ransom-note text or hard-coded values. The only named values are the victim's own domain and the indexing platform's URL, neither of which is an artefact of the threat. Authoring a rule against them would detect reporting about the incident, not the incident. ## 7\. Sources - ransomware.live, "Victim: GERLON – lamashtu", https://www.ransomware.live/id/R0VSTE9OQGxhbWFzaHR1, published 2026-09-30\. Single source for this item; the listing is operator-supplied and unverified. ## 8\. Adverse Trace position We assess this as a low-confidence, single-source item. The only verified fact is that a leak-site listing naming GERLON appeared on 2026-09-30; the actor "lamashtu" has no MITRE ATT&CK profile in our reference data, so we do not attribute capability, motivation or tradecraft to it, and we do not treat the listing as proof that data was taken. No CVE, CVSS score or CISA KEV entry applies. For EMEA financial services clients the exposure is third-party and indirect: GERLON is an industrial supplier, and the practical question is whether any client has a procurement, ERP or shared-credential relationship with it. We will monitor for a victim statement, a data-leak sample, or any technical reporting that names an initial access vector or malware family, and we will reissue this advisory if the attribution or the confirmed impact changes. Clients with a GERLON dependency should confirm the supplier's status directly rather than act on the listing. --- [Read the original source →](https://www.ransomware.live/id/R0VSTE9OQGxhbWFzaHR1?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*