← All coverage

varonis.com

Disclosed Sep 28, 2026

Records
1
Files
12
Added
Sep 29, 2026

Infostealer/RAT compromise of a Varonis employee workstation (hostname MBATAOR-LTS, domain mbataor-lts.varonis.com). The 'Ultron' malware framework exfiltrated system info, network configuration, local user accounts, installed software, running processes, services, environment variables, Chrome credentials, clipboard contents, and sensitive documents including internal Varonis architecture and deployment runbooks (Halcyon, Lockbox, Quarry, Tidepool projects), as well as personal documents belonging to the user 'Miki Bataor' (CV, lease, car service history). Data was collected on 2026-09-17 and uploaded to C2 at 123.168.223.23:8443.

Search this dataset

Team members search this dataset here and through the API. Access is by invitation from your team admin, or by request.

Request access

Source files

Expand any file to inspect its column headers and the field each maps to.

collected_data_mbataor-lts/collected_data_mbataor-lts/collected_data/01_System_Info__records.csv
0 rows

File structure

Format: CSV·Delimiter: Comma·Has header: yes·Quote: "

Notes: No PII columns detected; all columns are system or machine metadata.

collected_data_mbataor-lts/collected_data_mbataor-lts/collected_data/02_Network_Adapters__records.csv
0 rows

File structure

Format: CSV·Delimiter: Comma·Has header: yes·Quote: "

Notes: No PII columns detected. Columns present: Name, Status, MacAddress, LinkSpeed. These are network interface details and do not contain personally identifiable information.

collected_data_mbataor-lts/collected_data_mbataor-lts/collected_data/02_Network_Info__records.csv
0 rows

File structure

Format: CSV·Delimiter: Comma·Has header: yes·Quote: "

Notes: All columns are system/network metadata (interface, IP, DNS) with no PII. No names, emails, addresses, or identifiers found.

collected_data_mbataor-lts/collected_data_mbataor-lts/collected_data/03_Local_Users__records.csv
0 rows

File structure

Format: CSV·Delimiter: Comma·Has header: yes·Quote: "

Notes: This is an unstructured list of local Windows user accounts; no PII fields are present. The 'Name' column contains usernames, but these are system account names (e.g., Administrator, Guest, mbataor) and not PII per the exclusion rules for internal IDs. Password hashes are obfuscated and not extractable here.

collected_data_mbataor-lts/collected_data_mbataor-lts/collected_data/03_User_Info__records.csv
0 rows

File structure

Format: CSV·Delimiter: Comma·Has header: yes·Quote: "

Notes: free-form text with embedded usernames; no structured columns

collected_data_mbataor-lts/collected_data_mbataor-lts/collected_data/04_Installed_Software__records.csv
0 rows
No column mapping was recorded for this file.
collected_data_mbataor-lts/collected_data_mbataor-lts/collected_data/05_Clipboard.txt
0 rows
No column mapping was recorded for this file.
collected_data_mbataor-lts/collected_data_mbataor-lts/collected_data/06_Running_Processes__records.csv
0 rows
No column mapping was recorded for this file.
collected_data_mbataor-lts/collected_data_mbataor-lts/collected_data/07_Services__records.csv
0 rows

File structure

Format: CSV·Delimiter: Comma·Has header: yes·Quote: "

Notes: No PII columns detected; the file contains only Windows service names and status codes.

collected_data_mbataor-lts/collected_data_mbataor-lts/collected_data/08_Environment_Variables__records.csv
1 rows

File structure

Notes: free-form text with embedded emails / phones

collected_data_mbataor-lts/collected_data_mbataor-lts/collected_data/Stolen_Documents_Manifest.csv
0 rows
No column mapping was recorded for this file.
collected_data_mbataor-lts/collected_data_mbataor-lts/collected_data/Ultron_Execution_Log.txt
0 rows
No column mapping was recorded for this file.