{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/whitearmor/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Whitearmor"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AmplifAI (GoDaddy instance)"],"_cs_severities":["high"],"_cs_tags":["ransomware","data-theft","identity","cloud"],"_cs_type":"threat","_cs_vendors":["AmplifAI","GoDaddy"],"content_html":"\u003cp\u003eThe Whitearmor ransomware group has claimed a successful breach of an AmplifAI instance used by GoDaddy. The actors exfiltrated a significant volume of data, including a database of 13,565 employees, operational rosters, and login logs detailing device usage and access locations. The leak confirms that the compromised instance is integrated with the GoDaddy Okta tenant, providing specific application IDs and federation metadata for Okta and Office 365. This presents a high risk of credential stuffing or session hijacking against the affected identity providers.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe exfiltrated dataset contains sensitive employee information (names, emails, employee IDs, and password hashes/states) for over 13,500 individuals. Additionally, the exposure of Okta SSO and O365 federation parameters creates a direct risk for identity-based attacks targeting GoDaddy corporate systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReview Okta and Office 365 logs for anomalous access originating from accounts identified in the leaked database.\u003c/li\u003e\n\u003cli\u003eRevoke and rotate credentials for any accounts found with non-default passwords in the leaked 'all_users.json' file.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized OIDC/SAML application access attempts utilizing the exfiltrated Application IDs (e.g., exksdlj2ty3Pfq9En0x7).\u003c/li\u003e\n\u003cli\u003eImplement or enforce phishing-resistant Multi-Factor Authentication (MFA) for the identified GoDaddy Okta tenant.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-01T23:00:52Z","date_published":"2026-11-01T23:00:52Z","id":"https://feed.craftedsignal.io/briefs/2026-11-whitearmor-amplifai/","summary":"The Whitearmor ransomware group exfiltrated a large-scale employee database, login logs, and operational rosters from a GoDaddy AmplifAI instance, exposing Okta SSO and Office 365 federation details.","title":"Whitearmor Ransomware: Data Breach of AmplifAI GoDaddy Instance","url":"https://feed.craftedsignal.io/briefs/2026-11-whitearmor-amplifai/"}],"language":"en","title":"CraftedSignal Threat Feed - Whitearmor","version":"https://jsonfeed.org/version/1.1"}