On 26 October 2026, the Atos Threat Research Center published what it describes as the first in-depth technical analysis of Mimori, a ransomware and extortion group that appeared publicly in late October 2026 by claiming major technology companies as victims. Atos found and secured an exposed Mimori operations workspace holding more than 3,100 files, including the group's tools, internal notes, execution logs and a draft ransom note. The title of the Atos report sums up its view: the ransomware brand is new, but the people behind it probably are not.
Who Mimori is
Atos describes a mature and heavily automated operation that follows the same playbook from one victim to the next. Internal notes and operator instructions were written in Russian, which Atos treats as a language clue only, not proof of nationality or location. Atos found no confirmed links to any established ransomware group, and no Mimori-specific encryption program in the material it reviewed. Mimori is also the group that listed AVEVA on its leak site on 20 October, a claim that is still unverified. The Atos report does not name AVEVA or any other victim. Our earlier advisory on AVEVA's own bulletin is here: https://www.redtigersecurity.com/advisory/aveva-corporate-sharepoint-unauthorized-access
What they go after
According to Atos, the operators focus on the systems that give them the widest control and that a victim needs most to recover:
• Identity systems. Active Directory is the Windows directory that controls user accounts and permissions. Active Directory Federation Services lets those same accounts sign in to cloud services such as Microsoft 365. Atos found tooling that tried to turn on-premises credentials into cloud access.
• VMware vCenter and ESXi. ESXi is the hypervisor, the software layer that runs many virtual servers on one physical machine, and vCenter is the management console that controls all of those hosts. Atos found that Mimori used vCenter as a route into the wider ESXi environment, and pulled Active Directory password data straight out of the virtual disks of domain controllers, the servers that run Active Directory, from the hypervisor, without running anything inside Windows where security tools would see it.
• Backup systems. The operators mapped Veeam, NetBackup, Data Domain and other backup repositories. Atos did not confirm that any backups were deleted or encrypted, but mapping them is how an attacker gets ready to take recovery off the table.
• Cloud exfiltration. Stolen data was copied automatically to several commercial cloud storage services using rclone, a legitimate file transfer tool, and cleanup scripts then removed the traces.
For the final stage, the group's tooling was built to shut down domain controller virtual machines from the hypervisor and leave them unable to start again. That takes out sign-in and many other services at the exact moment the victim is trying to respond.
What is new: a known vCenter vulnerability at the center
Atos says exploitation of CVE-2026-59310 against vCenter played a major role in the attack. The workspace held a proof of concept, meaning working test code, for this flaw, which gives an attacker command execution through the vCenter Syslog service, the part of vCenter that collects log messages. Atos is careful to say the evidence does not prove which flaw gave Mimori its first way in. The draft ransom note itself claimed the intrusion started through internet-facing virtual private network (VPN) and virtualization products.
Broadcom, which owns VMware, fixed CVE-2026-59310 in security advisory VMSA-2026-0006 on 29 July 2026. Broadcom rates it critical, 9.8 out of 10 on the Common Vulnerability Scoring System, and lists no workaround. The fixed versions are vCenter 9.1.0.0300, 9.0.2.0100 and 8.0 Update 3k, with an 8.0 Update 2f express patch also available. Customers on vCenter 7.0 need to contact Broadcom under an extended support contract. The Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on 18 August 2026 and lists it as known to be used in ransomware campaigns.
What it means for OT owners
Many plants now run their supervisory control and data acquisition (SCADA) servers, human-machine interfaces (HMIs), historians and engineering workstations as virtual machines on VMware vSphere and ESXi. The operational technology (OT) domain controllers and backup servers are the recovery path after an incident. That makes the hypervisor and the backup layer part of the control system, even though no controller in the field is ever touched. Someone who holds vCenter can power off every virtual HMI and historian at once and go around every security tool installed inside those machines. An OT vCenter server that is joined to the corporate domain or managed from the business network is exactly the kind of bridge this approach is built to cross.
What the Red Tiger team recommends
1. Patch vCenter for CVE-2026-59310 to Broadcom's fixed versions, following your change-control process and planning the work around the process. Put vCenter and ESXi management on their own isolated management network that corporate users and general OT user networks cannot reach.
2. Keep OT virtualization and backup administrator accounts separate from corporate Active Directory, never reuse them anywhere else, and protect them with phishing-resistant multifactor authentication (MFA), such as hardware security keys.
3. Keep offline or immutable copies of OT server backups, meaning copies that cannot be changed or deleted, including domain controllers, SCADA servers, historians and engineering workstation images. Test restoring them on a schedule.
4. Monitor the vCenter, ESXi and backup consoles. Send their logs somewhere an attacker cannot erase them, and alert on new administrator logins, many virtual machines shutting down at once, changes to backup jobs and unexpected outbound connections from hypervisors.
Atos says its analysis is still ongoing and the report will be updated. Technical indicators for threat hunting are in the Atos report.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Source: https://www.atos.ai/en/news-insights/blog/TRC-mimori-ransomware-new-its-operators-probably-are-not
Broadcom advisory VMSA-2026-0006: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
Check out our resources and book a follow-up call with our team.
