> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Ransomware: lockbit5 named taspenlife.com (KZ)
- URL: https://f4n6.co.uk/security-feed/ransomware-lockbit5-named-taspenlife-com-kz/
- Published: 2026-09-26T23:53:56.000Z
- Updated: 2026-09-26T23:53:56.000Z
- Author: Jeff Davies
- Tags: #security-feed, lockbit5

## 1\. Executive summary

A leak-site listing posted on 2026-09-25 names taspenlife.com, a Kazakhstan life and health insurer, as a victim of the group operating under the name "lockbit5". The listing is indexed by Ransomware.live and carries no technical detail: no initial access vector, no malware family, no sample, no ransom demand, and no proof-of-data publication beyond a leak screenshot. The same index shows lockbit5 listings against three further financial-services entities in the Netherlands and Belgium (fpmanagement.nl, fdcputman.nl, takt.be), which places the cluster inside EMEA financial services rather than at its edge. The verified reference data holds no MITRE ATT&CK profile for "lockbit5", so the attribution to any known LockBit lineage is unconfirmed and should not be treated as established. For EMEA clients the exposure is indirect but concrete: an insurance counterparty in a third country has been publicly named, and the same actor is active against trust, mortgage and notarial firms in the EU.

## 2\. Regulatory framing

| Article                                                                 | Trigger (the fact in this item)                                                                                               | Practical impact                                                                                                                                                                                                  |
| ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28: ICT third-party risk, general principles                  | taspenlife.com is a named insurance counterparty; the listing is the only public signal of an incident affecting it           | Clients with a contractual or reinsurance relationship to this entity must treat it as a third-party ICT risk event and obtain a status statement from the counterparty rather than relying on the leak-site post |
| DORA Art. 30: key contractual provisions with ICT third-party providers | The listing gives no incident detail, so the only route to facts is the contract's audit, information and cooperation clauses | Where the counterparty is a critical or important function provider, invoke the contractual information right now; if the contract has no such clause, that gap is itself the finding                             |
| NIS2 Art. 21(2)(d): supply chain security measures                      | The same actor is listed against three EU financial-services entities in NL and BE in the same index                          | Entities in scope must be able to show supply chain security measures covering insurance and trust-office suppliers, not only technology vendors                                                                  |

No DORA incident-reporting article is engaged on the facts available. Art. 17, 18 and 19 attach to an incident at the reporting entity itself, and nothing in this item establishes that any Adverse Trace client has suffered one. If a client confirms its own operational disruption from this event, Art. 17 to 19 come into scope at that point.

## 3\. Technical analysis & attack chain

The source material does not support an attack chain. What is confirmed is a publication event, not an intrusion.

1. On 2026-09-25 at 12:40 UTC, Ransomware.live indexed a leak-site entry naming taspenlife.com as a lockbit5 victim, with country code KZ.
2. The entry carries a leak screenshot and no other artefact. No sample, no ransom note, no exfiltration proof, no negotiation transcript and no deadline are present in the indexed content.
3. The same index records lockbit5 entries against fpmanagement.nl (NL, a licensed trust office), fdcputman.nl (NL, a mortgage and insurance adviser) and takt.be (BE, a notarial practice). These are separate listings, not evidence of a shared intrusion.

The only quantitative material in the source is the Hudson Rock enrichment attached to the taspenlife.com entry: 1 compromised employee, 468 compromised users, 4 third-party employee credentials, and an external attack surface of 22\. That enrichment is a single-source data point and its definitions are not published in the material supplied. It is consistent with infostealer-derived credential exposure being present in the victim's user population, which is a common precursor to ransomware initial access, but the source does not state that any of those credentials were used in this incident. Treat the figures as an exposure indicator to be checked against your own credential-monitoring coverage, not as a confirmed access path.

Attribution is unconfirmed. The verified reference data contains no MITRE ATT&CK profile for "lockbit5". The name resembles the LockBit brand, and ransomware.live indexes it as a distinct group label, but nothing in the supplied material establishes a link to the original LockBit operation, to a successor, or to an unrelated actor reusing the name. Do not map this to LockBit TTPs in detection content or in an incident report without independent corroboration.

The absence of technical detail is itself informative. A listing with a screenshot and no sample or deadline is often an early post, sometimes used to pressure a victim before negotiation, and sometimes withdrawn. It can also be a false or inflated claim. Neither possibility can be resolved from this source.

## 4\. Mitigation & containment

P1 (within 24 hours)

- Establish whether your organisation has any contractual, reinsurance, outsourcing or claims-processing relationship with taspenlife.com. If yes, request a written status statement from the counterparty's security contact through the contractual channel, and record the request time.
- Check your own credential exposure against the enrichment figures. Search your identity provider and any credential-monitoring feed for accounts matching the taspenlife.com domain and for the four third-party employee credentials referenced. Where a match exists on an account with access to your environment, force a password reset and revoke active sessions and refresh tokens for that account.
- If you operate in the Netherlands or Belgium, confirm whether fpmanagement.nl, fdcputman.nl or takt.be appear in your supplier, client or counterparty records. The same actor label appears against all three.

P2 (within 72 hours)

- Enforce phishing-resistant MFA on all remote access, VPN, and identity-provider sign-in paths for accounts with access to production or payment systems. Credential exposure of the kind the enrichment suggests is defeated at the authentication layer, not at the perimeter.
- Review remote-access logs for the last 30 days for authentication from unexpected geographies or ASNs, with priority on accounts that have no MFA registered or that registered a new authenticator in the period.
- Confirm that backups for any system holding insurance, claims or policyholder data are immutable or offline, and that a restore has been tested in the last 90 days. A leak-site listing with no technical detail gives no warning of dwell time.

P3 (within 7 days)

- Map the insurance and trust-office entities in your supplier register against the lockbit5 listing set and record which are critical or important function providers. This is the Art. 28 and Art. 30 evidence trail.
- Where a critical supplier contract lacks an information and cooperation clause covering security incidents, raise it as a contract remediation item. The absence of incident detail in this listing is exactly the situation that clause exists for.
- Add the four listed domains to supplier risk monitoring so that any further leak-site activity against them is picked up without manual review.

No vendor fix, patch or version pin applies. This item names no vulnerable product or CVE.

## 5\. Indicators of compromise

The source material contains no atomic indicators: no hashes, no malware filenames, no C2 addresses, no registry keys and no ransom-note text. The only machine-pivotable values are the victim domains themselves, which are legitimate victim infrastructure and are listed here for tracking, not for blocking.

| type   | value               | confidence                            | source                              |
| ------ | ------------------- | ------------------------------------- | ----------------------------------- |
| domain | taspenlife\[.\]com  | high (named victim)                   | ransomware.live listing, 2026-09-25 |
| domain | fpmanagement\[.\]nl | high (named victim, separate listing) | ransomware.live corpus              |
| domain | fdcputman\[.\]nl    | high (named victim, separate listing) | ransomware.live corpus              |
| domain | takt\[.\]be         | high (named victim, separate listing) | ransomware.live corpus              |

Do not block these domains. They are the victims' own public web properties; blocking them breaks legitimate business traffic and does not affect the actor.

Behavioural indicators

| behaviour                                                                                                                | where to observe                                                          | confidence                                                  |
| ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------- | ----------------------------------------------------------- |
| Credential exposure in the victim's user population (1 employee, 468 users, 4 third-party employee credentials reported) | Credential-monitoring feed, identity provider sign-in logs                | low, single-sourced enrichment with unpublished definitions |
| External attack surface of 22 exposed services reported for the victim domain                                            | External attack surface management scan of your own estate for comparison | low, single-sourced                                         |

No copyable indicator block is provided. There are no atomic indicators in the source material.

## 6\. Detection

Insufficient indicators to author detection rules.

The source contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file paths, registry keys, ransom-note text or hard-coded values. The only strings available are the victim domain names and the group label, and a rule built on those would detect reporting about the incident rather than the incident. No YARA or Sigma rule is emitted.

If you need detection coverage for this actor cluster, the correct starting point is your existing credential-theft and remote-access detection set, not a rule derived from this listing.

## 7\. Sources

- Ransomware.live, "Ransomware: lockbit5 named taspenlife.com (KZ)", https://www.ransomware.live/id/dGFzcGVubGlmZS5jb21AbG9ja2JpdDU=, published 2026-09-25.
- Ransomware.live, "Victim: taspenlife.com – lockbit5" (Hudson Rock enrichment: compromised employees, users, third-party credentials, external attack surface), https://www.ransomware.live/id/dGFzcGVubGlmZS5jb21AbG9ja2JpdDU=, retrieved 2026-09-26.
- Ransomware.live, "Ransomware: lockbit5 named fpmanagement.nl (NL)", https://www.ransomware.live/id/ZnBtYW5hZ2VtZW50Lm5sQGxvY2tiaXQ1.
- Ransomware.live, "Ransomware: lockbit5 named fdcputman.nl (NL)", https://www.ransomware.live/id/ZmRjcHV0bWFuLm5sQGxvY2tiaXQ1.
- Ransomware.live, "Ransomware: lockbit5 named takt.be (BE)", https://www.ransomware.live/id/dGFrdC5iZUBsb2NrYml0NQ==.

All four listings are single-sourced to Ransomware.live, which indexes operator posts without verifying them. Verify before enforcement.

## 8\. Adverse Trace position

Adverse Trace assesses this as a low-confidence, low-detail listing with indirect EMEA impact. There is no CVE, no CVSS score and no CISA KEV entry to assess, because the item is a leak-site publication rather than a vulnerability. The attribution to "lockbit5" is unconfirmed: the verified reference data holds no MITRE ATT&CK profile for that name, and the source provides no technical artefact linking it to any known LockBit lineage or successor. The Hudson Rock enrichment figures are single-sourced with unpublished definitions and should be used as a prompt to check your own credential exposure, not as an established fact about the intrusion. The material risk to clients is counterparty and supply chain exposure, not a technical one: an insurer in Kazakhstan has been publicly named, and the same actor label appears against trust, mortgage and notarial firms in the Netherlands and Belgium. We will monitor the listing for a sample, ransom note, deadline or proof-of-data publication, and will reissue if technical artefacts appear or if any Adverse Trace client confirms its own operational impact, at which point DORA Art. 17 to 19 come into scope. Clients with a relationship to any of the four named entities should treat the counterparty status request in §4 as the first action.

---

[Read the original source →](https://www.ransomware.live/id/dGFzcGVubGlmZS5jb21AbG9ja2JpdDU=?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*