SOLENIS Data Breach

Vortex listed SOLENIS — a US manufacturing company — on its dark web victim site on 2026-11-10. SOCRadar observed the listing through dark web monitoring of the group’s victim site. SOLENIS joins Andersen Construction as the second US manufacturing firm in Vortex’s current active campaign window. The cross-sector listing alongside healthcare targets is consistent with Vortex’s approach within preferred geographies — the group selects for US-based organizations across multiple verticals rather than concentrating on any single one. Vortex’s operational tempo over a 60-day window is approximately 14 victims. Its geographic distribution is United States (primary) and Europe (secondary), with a sector distribution spanning healthcare, manufacturing, professional services, and retail. The group’s recent victim list includes Scripps (US, Healthcare), Arthrex (US, Healthcare), Andersen Construction (US, Manufacturing), and Karlstorz (DE, Healthcare). SOLENIS matches this pattern closely: it is a US-based organization that falls within the manufacturing sector, which is among the group’s most frequently targeted industries, and it aligns with the group’s preference for US-based organizations across multiple verticals.

Infostealer dataset query result: no matches. SOCRadar telemetry returned zero credential records attributed to SOLENIS at the time of analysis. However, coverage gaps for US manufacturing organizations are documented across commercial infostealer intelligence sources, and the null result does not establish absence of credential compromise. Credentials may exist under alternate corporate domains, may use personal email aliases, or may reside in feeds outside the queried dataset; records may also have been used and rotated before indexing or may not yet have been indexed. The absence of evidence in this telemetry should not be interpreted as evidence that no compromise occurred. The primary initial access vector for Vortex is infostealer malware, including Lumma, RedLine, and Stealc. These strains are distributed through dark web markets and Telegram. The mechanism underlying this vector is credential reuse: legitimate credentials harvested by infostealers bypass perimeter controls when used to access corporate accounts. This pattern illustrates how infostealer-harvested credentials may support ransomware operations — validated credentials can provide access to corporate environments, VPNs, and remote-access portals without requiring an exploit, potentially enabling ransomware deployment. No direct correlation was observed between SOLENIS and the queried telemetry, so this access method cannot be confirmed as the intrusion path in this incident; it represents the group’s known primary access vector rather than an established fact for this victim. Given the alleged listing and the threat actor’s reliance on infostealer-harvested credentials, the following actions are supported by the source: remote access hardening with phishing-resistant MFA on all VPN, RDP, and admin portals; continuous dark web telemetry for corporate domain exposure and credential monitoring; an access scope reduction through privileged access audit with least-privilege enforcement; and detection through authentication log review for anomalous login patterns. Continued dark web or stealer-log monitoring is recommended, as the null telemetry result does not rule out credential exposure that may surface in future datasets.