FulcrumSec Ransomware Decryption & Data Recovery

FulcrumSec came to the security community's attention in September 2025; some reporting uses the alias "The Threat Thespians". As of an 11 September 2026 tracker snapshot its leak site listed 27 organisations across a dozen countries, most headquartered in the United States - note that published counts range from 21 to 27 depending on the snapshot date and the counting method each tracker or vendor uses. Posting accelerated sharply through the first half of 2026, marking the group as a still-rising newcomer rather than an established brand.

The defining difference from a conventional ransomware family is that FulcrumSec does not encrypt at all. Independent analyses agree that no encryption payload has appeared in known incidents: systems keep running and files keep opening. The operators call the model "steal and squeeze" - move the data out, then force payment through public exposure and staged leaks.

Three landmark cases:

• LexisNexis (listed May 2026) - named as a victim in several vendor write-ups, but the initial access route has not been described publicly and should not be tied to any single vulnerability.
• Novo Nordisk (June 2026) - access claimed since March, a USD 25 million demand opened on 1 June, and after refusal staged publication from a claimed 1.3TB haul covering clinical trial data, source repositories and AI model assets.
• Manchester Airports Group (Aug-Sep 2026) - Iterable marketing platform API credentials exposed in airport website client-side JavaScript, yielding a claimed 86GB compressed (about 640GB expanded) and some 8.7 million customers, though reporting indicates the vast majority of those records contained only an email address.

Arup Group, Global Schools Foundation, Avnet, youX and Dustin Group have also been named. As of this update no mainland China organisation appears on the public victim trackers, but the selection criterion is exposure rather than geography: outbound SaaS products, cross-border e-commerce and manufacturers or pharmaceutical groups with overseas subsidiaries sit in the same target space the moment production keys land in frontend code or buckets are left open.

The counter-intuitive part first. A FulcrumSec incident has no encrypted extension, no ransom note file, no wallpaper change and no outage. Every file opens normally and the monitoring wall stays green. That is what makes it dangerous: most victims learn of the intrusion from outside, weeks or months after the data left.

How victims usually find out. The actors email executives or legal counsel directly with a file tree and sample data; a researcher forwards a polished breach write-up; or the company name simply appears on the leak site.

Cloud-side signals - none of which alert on their own, so they have to be hunted:

• Long-unrotated API keys, GitHub PATs or JWT signing secrets suddenly used from unusual geographies or outside working hours.
• Container identities or over-permissioned IAM roles performing bulk Secrets Manager or Key Vault enumeration.
• Sustained, slow, high-volume reads from cloud databases such as MongoDB Atlas, Redshift or Databricks.
• Bulk repository cloning, plus unusual exports from SaaS platforms including Salesforce, Qualtrics and Hugging Face.
• Large egress from legitimate transfer tooling such as rclone, riding normal cloud provider paths and defeating signature detection.

One frontend check worth doing today. Inspect the JavaScript bundles served from your public site and mobile web root domain for embedded administrative keys belonging to third-party marketing, support or analytics platforms. That was the entry point at Manchester Airports Group, and not on some obscure subdomain either.

Bottom line. Identifying FulcrumSec is exfiltration forensics, not malware analysis. There is no sample to collect - only logs to reconcile.

FulcrumSec's access playbook barely involves malware. It is built on credentials the victim published itself and doors that should have been closed:

• Hardcoded and exposed credentials. Third-party SaaS administrative keys in frontend JavaScript, GitHub personal access tokens in public repositories, Azure container registry credentials, and JWT signing secrets left unrotated for years. None of these require an exploit.
• Internet-facing vulnerabilities. CVE-2025-55182 (React2Shell), disclosed on 3 December 2025, is an unauthenticated deserialisation RCE in React Server Components carrying a CVSS of 10.0 and now in CISA's Known Exploited Vulnerabilities catalog. Vendor write-ups list it among this group's exploitation methods, but no public report ties it to a specific named intrusion.
• Misconfigured cloud storage and data services. Publicly reachable S3 buckets and Azure storage accounts, unauthenticated MongoDB Atlas clusters, exposed Databricks notebooks and open directories.
• Infostealer logs and initial access brokers. Valid credentials and session cookies bought on criminal markets, the latter useful for bypassing multi-factor authentication.

Lateral movement follows permissions, not networks. Instance metadata services are queried for temporary credentials, over-permissioned roles enumerate secrets in bulk, and tokens get reused across development, staging and production.

Dwell time is long. Weeks to months: in the Novo Nordisk case the actors claimed access from March and only made contact in June, spending the interval on quiet, methodical collection. That is the opposite of encrypting families that detonate within days, and it usually means log retention does not cover the whole intrusion.

Read this section in reverse for FulcrumSec: it does not encrypt.

No FulcrumSec encryptor appears anywhere in public analysis. Extensions are untouched, shadow copies are not deleted, database services are not stopped, virtual disks are not encrypted and ESXi is not targeted. Algorithms, intermittent-encryption strides and shadow-deletion commands - the usual ransomware analysis vocabulary - simply do not apply.

Exfiltration replaces it. Data is packaged and moved with legitimate tooling such as rclone over normal cloud egress paths, chunked and throttled to stay under volume alerting. Because the binaries and APIs are legitimate, signature detection contributes almost nothing. Published case volumes range from tens of gigabytes to more than a terabyte, but every one of those figures is an attacker claim and has to be re-derived from your own logs.

Pressure tactics stand in for encryption: staged publication of samples and full file trees; polished, partly AI-generated write-ups pushed to security media and researchers; themed shaming sections blaming the victim's negligence; and a stated willingness to sell a dataset exclusively to a single buyer - escalating the cost of refusal from exposure to resale.

What this means operationally. No outage does not mean small loss. The damage comes from personal-data compliance exposure, customer and regulator pressure, leakage of source code and AI model assets, and reuse of stolen records for targeted phishing. Measuring severity by whether systems went down badly understates the risk.