PEAR Team Leaks 1.8 TB of Exchange Group Databases

Technical Breakdown of the PEAR Team Attack Chain

The PEAR Team demonstrates high operational discipline, exhibiting an average network dwell time between 22 and 41 days. This extended dwell period allows the threat actors to map the internal network infrastructure, harvest high-privilege credentials, and locate the highest-value data repositories before triggering any security alerts.

Step 1: Initial Access and Dwell Time

Initial compromise is achieved predominantly through credential abuse. PEAR Team operators systematically harvest or purchase valid VPN and RDP credentials. These credentials are acquired from public breaches, credential stuffing lists, or active infostealer logs distributed on the dark web. Secondary access pathways include targeted spear-phishing campaigns designed to execute loaders that bypass standard perimeter controls.

Step 2: Living off the Land and RMM Abuse

To avoid triggering endpoint detection and response (EDR) platforms, the attackers minimize the use of custom compiled malware. Instead, they rely on Living off the Land (LotL) techniques, running administrative utilities already present on the host system. They use PowerShell and PsExec for local execution and lateral movement across the internal domain.

Persistence is maintained through the unauthorized installation of legitimate, commercial Remote Monitoring and Management (RMM) software. Specifically, PEAR installs AteraAgent and Splashtop Remote Service. Because IT administrators widely use these applications, security operation centers often whitelist them, allowing PEAR to establish persistent, redundant command and control (C2) channels without generating security incidents.

Step 3: Targeted Discovery and Data Collection

Once persistence is secured, PEAR conducts targeted internal reconnaissance. The threat actors systematically query active directory domains to locate file servers, domain controllers, and cloud-synced backups. They run local script searches for specific file types and keywords, focusing on database platforms like Sage and QuickBooks, which contain core corporate ledger and transaction details. Data is then staged in hidden directories and compressed using standard utility binaries like 7-Zip or WinRAR.

Step 4: Stealthy Exfiltration via Renamed Binaries

The compressed files are transferred off-network using robust command-line tools like RClone or WinSCP. To evade network traffic monitoring and command-line detection rules, PEAR regularly renames these utility binaries to mimic legitimate Windows system processes. The files are streamed to external hosting servers managed by the threat actors via encrypted protocols, making deep packet inspection difficult without active TLS decryption.

Enterprise Security and Compliance Risks

The leak of 1.8 TB of financial and operational databases poses severe security and regulatory risks. When accounting database structures like Sage and QuickBooks are exposed, malicious actors gain access to client transaction histories, vendor bank details, tax documents, and business-critical operational structures. This data provides downstream attackers with the exact intelligence required to execute convincing vendor-impersonation and business email compromise (BEC) campaigns.

Furthermore, because the compromise includes PII, PHI, and sensitive corporate records, affected entities face severe regulatory scrutiny. Organizations operating internationally or processing data across jurisdictions must maintain rigorous visibility over their digital assets. In the GCC region, strict regulatory frameworks require enterprises to implement proactive threat hunting and continuous visibility over their internet-facing assets.

To evaluate if your outward-facing configurations are vulnerable, utilizing Attack Surface Management can help discover exposed remote access portals, out-of-date VPN gateways, and unpatched assets before threat groups discover them.

Advanced Detection Logic for Security Operations

To detect the presence of PEAR Team actors or similar data-only extortion groups, security teams must deploy behavioral detection rules that focus on administrative tool abuse and anomalous data egress patterns.

Splunk SPL: Detecting Potential RClone Data Exfiltration

This Splunk search identifies the execution of RClone or renamed command-line copy utilities by analyzing execution arguments often associated with data staging and remote synchronization:

index=windows EventCode=4688 
| search CommandLine="*rclone copy*" 
     OR CommandLine="*rclone sync*" 
     OR CommandLine="*--config*" 
     OR (Image!="*rclone.exe" AND CommandLine="*copy* --config*")
| table _time, host, AccountName, Image, CommandLine

Microsoft Sentinel KQL: Detecting Legitimate RMM Tool Abuse

This query detects unauthorized or anomalous executions of AteraAgent or Splashtop outside of their standard installation paths, signaling potential actor persistence:

DeviceProcessEvents
| where ProcessCommandLine has_any ("AteraAgent", "Splashtop", "AteraAgent.exe")
     or FileName has_any ("AteraAgent.exe", "Splashtop")
| where not(FolderPath startswith @"C:\Program Files\Atera Networks\") 
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, FolderPath, ProcessCommandLine

Containment and Immediate Mitigation Protocols

If you suspect an active intrusion or credential compromise, execute the following containment measures immediately:

• Revoke and Reset Credentials: Force an immediate, system-wide password reset for all Active Directory, VPN, and RDP accounts. Terminate all active sessions across SaaS and internal environments.

• Enforce Multi-Factor Authentication: Mandate robust MFA, preferably phishing-resistant methods, on all external connections and internal administrative consoles.

• Audit RMM Solutions: Inventory all endpoints for unapproved instances of Atera, Splashtop, AnyDesk, or other remote access utilities. Block any agents that are not authorized by internal IT management.

• Isolate Affected Hosts: Use EDR network isolation controls to quarantine suspicious servers or workstations to halt lateral movement and ongoing data transfer.

• Implement Immutable Backups: Ensure that backup infrastructure is isolated from the primary network and is stored in an immutable, write-once, read-many configuration.

Organizations must realize that the first indicator of a breach is often the appearance of corporate credentials on underground networks. To systematically assess your external exposures, implementing continuous monitoring is critical.

For long-term protection, deploying comprehensive Dark Web Monitoring ensures that your security teams receive immediate notifications whenever enterprise credentials or internal datasets are identified on underground forums, Tor sites, or hacker chat channels.