PEAR
An extortion group that steals data and threatens to publish it, without encrypting anything. At-Bay reports that it logs in using compromised VPN credentials and relies on legitimate administration tools.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
At-Bay says PEAR operates exclusively through data theft and public shaming.1 Researchers quoted by BankInfoSecurity say it appears to be a data broker and extortion group that skips encryption.2 That changes the response: restoring from backup does nothing about stolen data being published.
The pressure is direct. At-Bay reports text and WhatsApp messages to employees, daily check-ins during negotiation and strict deadlines.1
At-Bay notes a focus on US-based organisations, from small businesses to larger enterprises.1 The sources do not establish a UK link.
With no custom malware reported, signature-based tools have little to catch. We would focus on VPN credential hygiene and on spotting bulk transfers.
How It Attacks
Based on At-Bay's incident response reporting, published in February 2026.1
- 1
Log In
Uses compromised VPN credentials, likely from earlier breaches or credential stuffing, to sign in with valid accounts.
- 2
Stay Connected
Installs legitimate remote management tools instead of custom malware.
- 3
Spread and Harvest
Uses PsExec and credential dumping utilities to move across the network.
- 4
Take the Data
Moves data out with WinSCP and Rclone, sometimes renamed to avoid detection.
- 5
Apply the Pressure
Lists victims on a leak site, threatens staged releases and messages employees directly.
Key Techniques
Our mapping of the behaviour At-Bay describes.1 PEAR has no ATT&CK v20 entry.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1078 | Valid Accounts | Initial Access | Signs in with compromised VPN credentials. |
| T1133 | External Remote Services | Initial Access | Uses VPN access as the entry point. |
| T1219.002 | Remote Desktop Software | Command and Control | Uses remote management tools for persistence. |
| T1021.002 | SMB/Windows Admin Shares | Lateral Movement | Uses PsExec to move between systems. |
| T1003 | OS Credential Dumping | Credential Access | Uses credential dumping utilities. |
| T1036 | Masquerading | Stealth | Renames file transfer tools to avoid detection. |
| T1048 | Exfiltration Over Alternative Protocol | Exfiltration | Moves data out using WinSCP and Rclone. |
Tools Observed
Remote Access
Movement and Credentials
Exfiltration
From At-Bay.1 All have legitimate uses, so finding one does not prove compromise.
Warning Signs
Drawn from At-Bay's reporting.1 None of these proves an attack alone.
- VPN sign-ins from unusual locations using valid accounts
- Unexpected AteraAgent or Splashtop services
- WinSCP or RClone activity, including renamed binaries
- Staff receiving texts or WhatsApp messages claiming data has been stolen
Defences That Matter
Secure VPN Access
- Require MFA on VPN access, since At-Bay reports entry through compromised VPN credentials.1
- Remove unused accounts and check for reused passwords.
Watch for Hands-On Activity
- Monitor for unapproved remote access tools, renamed file transfer utilities and large outbound transfers.
- Alert on attempts to stop security tools or delete shadow copies.
Limit What Can Leave
- Know where your most sensitive data sits and restrict access to it.
- Alert on bulk transfers to cloud storage and unfamiliar destinations.
Plan for Extortion
- Decide in advance who handles legal, regulatory and client communication if data is published.
- Rehearse a data theft scenario where backups do not solve the problem.
Could Stolen VPN Credentials Reach Your Data?
We can test your remote access and data exposure and help you close the gaps.
Sources
- At-Bay: Pure extraction ransomware groups prioritize data theft, 11 February 2026
- BankInfoSecurity: Medical billing vendor hack affects 1.3M patients, 28 July 2026
- Comparitech: Ransomware roundup, April 2026, 5 May 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.