Tharisa Data Breach

UmBra ransomware group listed Tharisa, a South African mining and processing company specializing in platinum group metals and chrome, on its dark web portal on October 7, 2026. This marks Tharisa as the sole manufacturing sector victim among UmBra’s observed targets. Telemetry data from tharisa[.]com revealed significant findings, including 17 records with recent @tharisa.com credentials impacting Microsoft’s identity infrastructure, with the latest dated September 20, 2026. The nature of Tharisa’s operations and its location in South Africa likely made it an attractive target for ransomware actors seeking to disrupt critical infrastructure or extort significant financial gains. In the preceding 60 days, UmBra has claimed four other victims: Raqib (Saudi Arabia, technology), SANAtech Global Solutions (Egypt, technology), Four Hands LLC (US, other), and Beni Suef Technological University (Egypt, education). The group’s geographical focus encompasses Egypt, South Africa, and Saudi Arabia. Tharisa represents UmBra’s first manufacturing victim and second listing from South Africa. This victim profile aligns with UmBra’s broader targeting patterns, which often include entities in the technology and education sectors, though their inclusion of a manufacturing company like Tharisa highlights a potential diversification in their attack strategy.

SOCRadar’s investigation found 17 stealer-log records related to tharisa[.]com, categorized as follows: 5 employee credentials on Tharisa’s identity and mail infrastructure (Category A), 3 records involving third-party or external users on Tharisa-operated systems (Category B), and 3 corporate credentials on third-party SaaS platforms (Category C), with 1 record being unclear. Key endpoints identified include Microsoft Azure Active Directory (login.microsoftonline[.]com) with multiple @tharisa.com accounts, the Exchange OWA portal at webmail.tharisa[.]com/owa, and Adobe SaaS. Notably, a single corporate identity appeared across both Microsoft IdP and Adobe endpoints over a 14-month period, from May 2025 to September 2026. This continuity suggests a persistent endpoint infection or that credentials were not rotated after an earlier compromise. The freshness of the log data spans from August 2024 to September 2026, with the most recent record dated September 20, 2026. The pattern of fresh credentials dated September 20, 2026, approximately three weeks before the ransomware listing, aligns with UmBra’s typical initial access methodology. This involves sourcing credentials from underground markets, validating them against enterprise identity systems, and subsequently using them for network intrusion prior to ransomware deployment. The identified @tharisa.com credentials targeting Microsoft 365 infrastructure are indicative of the potential pathways UmBra may exploit. The presence of these credentials on these specific endpoints does not confirm a successful intrusion but highlights a significant risk of unauthorized access. Given the observed credential exposure and the typical modus operandi of UmBra, immediate actions are recommended. Organizations should enforce credential rotation for all affected @tharisa.com accounts. A thorough review of Azure AD sign-in logs for anomalous access between September 20 and October 7, 2026, is crucial. Furthermore, implementing Multi-Factor Authentication (MFA) across Microsoft 365 and any other platforms identified within the stealer sample should be a priority to mitigate further risks. Continued monitoring of dark web marketplaces and stealer logs for any new Tharisa-related information is also advised.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.