Whitearmor Ransomware: Data Breach of AmplifAI GoDaddy Instance

The Whitearmor ransomware group has claimed a successful breach of an AmplifAI instance used by GoDaddy. The actors exfiltrated a significant volume of data, including a database of 13,565 employees, operational rosters, and login logs detailing device usage and access locations. The leak confirms that the compromised instance is integrated with the GoDaddy Okta tenant, providing specific application IDs and federation metadata for Okta and Office 365. This presents a high risk of credential stuffing or session hijacking against the affected identity providers.

Impact

The exfiltrated dataset contains sensitive employee information (names, emails, employee IDs, and password hashes/states) for over 13,500 individuals. Additionally, the exposure of Okta SSO and O365 federation parameters creates a direct risk for identity-based attacks targeting GoDaddy corporate systems.

Recommendation

• Review Okta and Office 365 logs for anomalous access originating from accounts identified in the leaked database.
• Revoke and rotate credentials for any accounts found with non-default passwords in the leaked 'all_users.json' file.
• Monitor for unauthorized OIDC/SAML application access attempts utilizing the exfiltrated Application IDs (e.g., exksdlj2ty3Pfq9En0x7).
• Implement or enforce phishing-resistant Multi-Factor Authentication (MFA) for the identified GoDaddy Okta tenant.