Summary
- The recovered dataset describes a structured ransomware operation rather than a single isolated tool.
- Identity systems, virtualisation platforms and backup environments are central targets.
- Atos did not confirm every claimed victim or conclusively identify the operators.
A ransomware operation using the name Mimori appears equipped for sustained intrusion into enterprise identity infrastructure, virtualisation platforms and backup systems, according to research based on more than 3,100 files recovered from an exposed attacker environment.
The Atos Threat Research Center published its investigation on 26 October 2026. The recovered material included scripts, remote-access tools, configuration information, execution logs and internal documentation that collectively describe a structured operation.
Mimori recently began making public claims about attacks against major organisations. Atos examined evidence associated with the group but did not establish the truth of every criminal claim or independently confirm the full list of purported victims.
The researchers assessed the operation as technically mature despite its relatively recent public appearance. Automation, operational documentation and the range of available tools suggested experience exceeding what might be expected from a newly assembled group.
Some instructions were written in Russian, but language does not establish the nationality or location of operators. Atos also did not identify definitive evidence linking Mimori to a particular established ransomware group.
The most striking aspect of the recovered material was the focus on privileged access to enterprise infrastructure. Scripts and tooling targeted Microsoft's Active Directory environment, associated authentication systems and technologies that connect on-premises identities with cloud services.
Active Directory manages credentials and access permissions across many enterprise networks. An attacker obtaining privileged control over that infrastructure may be able to reach additional systems without needing separate entry points into each server.
Atos also identified substantial activity around VMware vCenter and ESXi. These products manage virtual machines and hypervisor infrastructure widely used to host business applications, databases and identity services.
Compromise of a central virtualisation platform can expose multiple workloads, depending on its configuration and the privileges obtained. The recovered toolkit included techniques for extracting information from virtualised domain controllers through their underlying disk images.
Researchers also found references to exploitation of a previously patched VMware vulnerability, CVE-2026-59310. Its presence in attacker tools does not establish that it served as the initial entry point for every Mimori operation, however.
Indeed, Atos could not assign one universal initial-access route to the group. The files suggest a range of opportunities involving exposed infrastructure, remote access and compromised credentials, but the relationship between individual tools and confirmed victim incidents remains uncertain.
Recovery infrastructure was another area of interest. The recovered data contained material related to products including Veeam, NetBackup and Data Domain, which organisations use to protect and restore business information.
Understanding backup environments can give an attacker visibility of repositories, accounts and potential recovery dependencies. The files do not prove that every backup system examined was deleted, disabled or encrypted, but the interest is consistent with attempts to reduce a target's capacity to recover.
The operation also used legitimate file-transfer and cloud storage capabilities that could support data collection and exfiltration. Ordinary administrative tools can provide effective concealment where defenders are unable to distinguish authorised transfers from hostile activity.
Several recovered components concerned persistence and remote execution. Combined with privileged credential access, these could allow activity to continue after the initial compromised system has been remediated.
The pattern is relevant to industrial and infrastructure organisations because virtualisation and identity systems increasingly support production-adjacent services, engineering workstations, historians and management platforms. Disruption to those shared dependencies may affect operations even without direct compromise of an industrial controller.
The research has not identified a newly developed Mimori encryptor or established the complete extent of the group's successful ransomware incidents. Its strongest evidence concerns the capabilities and behaviour reflected in recovered operational material, rather than the group's unverified public statements.
Atos indicates that the investigation is continuing. The current dataset establishes a deliberate focus on identity, hypervisors and recovery infrastructure while leaving attribution, the initial access used in individual incidents and the actual victim count open.
