WhiteArmor Ransomware Recovery: New Extortion Group Claiming Whirlpool and Hisense
WhiteArmor posted its first victim on 21 or 22 October 2026, depending on the tracker, and had listed 18 by 1 November (ransomware.live). Six are in the United States, with single victims in the Philippines, Germany, Argentina and China; technology, transport and retail companies are named most often. Its claims include the appliance makers Whirlpool and Hisense, and the online gambling site Gamdom.
Cybernews reported that the group claimed 19 GB of data from Hisense and demanded 5 million US dollars. None of these claims had been confirmed by the companies at the time of writing.
Encryption or data theft only?
Early reporting describes WhiteArmor as a data-theft and extortion group, and no encryptor has been linked to it publicly. That can change quickly with a new group, and it is not confirmed that none of its victims had files encrypted. We will update this page as reliable analysis appears.
WhiteArmor ransomware data recovery: what to do
Find out how the attackers got in and what they took: preserve firewall, VPN and cloud audit logs, and change the passwords and keys of every account they may have used. If any servers, databases or backups were encrypted, keep the encrypted files and do not reinstall. We recover databases, virtual machines and backups from ransomware-damaged files. Contact us for a free assessment. No data, no charge.
Veeam backups, SQL Server or Oracle databases encrypted by WhiteArmor?
Ransomware groups go after the backup repository first. A .vbk or .vib file renamed by the ransomware is often not lost: large backup files are usually only partly encrypted, and the intact blocks can be verified and rebuilt into the virtual disks. The same holds for SQL Server MDF and BAK files and for Oracle datafiles and Data Pump exports: the rows the ransomware did not reach can be read directly. In real cases we rebuilt a 466 GB server disk from a 43 GB Akira-encrypted VBK, and recovered 98.8% of the rows from LockBit-encrypted SQL Server backups.
- Ransomware-encrypted Veeam VBK recovery →
- AS VBK Recovery Studio: free analysis of an encrypted VBK →
- Ransomware-encrypted SQL Server database recovery →
- AS SQL Recovery & Repair Studio: free analysis of an encrypted MDF or BAK →
- Ransomware-encrypted Oracle database recovery →
- NAS and RAID ransomware recovery →
- Ransomware-encrypted VMware VMDK recovery →
WhiteArmor ransomware data recovery: contact us now
We have already solved 656+ ransomware and data recovery cases: encrypted and corrupted SQL Server, Oracle and MySQL databases, Tally, Busy and Marg ERP data, Veeam backups, VMware and Hyper-V virtual machines, RAID and NAS. Send us the details and we tell you what we can recover.
- ✓ Free assessment before you pay anything
- ✓ No data, no charge
- ✓ NDA on request
Email: info [at] asittech.com · Mon–Fri, 9:00–18:00 IST