← Zur Übersicht
Gruppe
Everest
Erfassungsdatum
Status
Online / unverändert
Land
Vereinigte Staaten

Hinweise zur Einordnung

Dieser Eintrag dokumentiert eine Veröffentlichung der Gruppe. Ein Angriff oder Datenabfluss ist damit nicht unabhängig bestätigt.

Konfidenz ist eine heuristische Einschätzung. Prüfzeitpunkte beziehen sich auf die Anreicherung, nicht auf unabhängige Verifikation. Herkunft und Korrekturen finden Sie unter „Firmeninformationen & Datenherkunft“.

Ergänzende Einordnung
SektorTechnologie & IThohe Sicherheit
Veröffentlichungsdatum13.10.2026, 18:03 Uhrhohe Sicherheit · OSINT-Abgleich
Firmeninformationen & Datenherkunft

Angaben der Ransomware-Gruppe

Unbestätigt

Quellentext als öffentliche Metadaten wiedergegeben. Die Aussagen wurden nicht unabhängig geprüft; Links sind ausgeblendet.

[Link entfernt] 41 GB DataBase

1. EXECUTIVE SUMMARY

The data consists of satellite-terminal software, communications-platform source code, firmware

releases, engineering drawings, commissioning resources, support tools and operational diagnostics.

It covers KVH TracPhone, TracNet and TracVision equipment alongside components supplied by OneWeb,

Intellian, MaxLinear, iDirect, Newtec, Viasat, Iridium and other providers.

The folder holds 268 files and 66 subfolders, occupying 40.73 GB. Its 60 standard archives contain

software packages, source files, configuration sets and support exports. Firmware images account for

much of the stored volume; readable application code is also embedded in older product packages.

The substantive software findings include KVH Log File Parser 4.72, the ICM and TVRO web/control

layers, and a substantial CommBox application platform. CommBox contains interconnected functions

for selecting communications channels, transferring files over intermittent links, handling mail,

managing crew accounts, controlling usage, configuring networks and reporting vessel status to

shore.

The OneWeb material includes application scripts, recoverable TypeScript for the ACS interface, API

descriptions, telemetry schemas and a MaxLinear MoCA software development kit. The kit includes

C/C++, Linux driver support, operating-system abstractions, diagnostics and board-specific

adaptations. The compiled OneWeb and Viasat updaters also provide recoverable client logic for

component updates, compatibility checks and service recovery. Supplier code and integration changes

have separate provenance from explicitly marked KVH code. Velocity exposes a modem-conversion

workflow on Windows and macOS; TPV Flash Wizard exposes native controller-transfer and

parameter-preservation logic.

The operational records include 11 SQLite databases, terminal configurations, incident exports,

antenna logs and a substantial radio-signal time series. Their contents connect equipment events,

network conditions, antenna state and navigation-related fields to service cases.

The material reveals product architecture, message formats, service procedures, deployment settings

and technical operating conditions. Some source code is incomplete or dependent on external

binaries. The 131 stored encrypted firmware files, plus two encrypted SWU files inside Thales

packages, retain an explicit boundary on knowledge of their internal contents.

Support materials cover PVT Emerald, PVT Venus, Tanusha, JANA 508, Intellian AIM incidents and

Excelerate Energy - Shenandoah. MY Reverie contains installation settings and satellite coverage

data. These materials include equipment configurations and records of its operation.

The data contains implementation details, service access settings, device configurations,

operational history and resources for individual installations. Supplier libraries, reference

schemas and blank service forms are also present.

The follow-up of 2 October 2026 closed the former queues for PVT Venus images, visual video content,

internal TV8 CAD, OneWeb resources and Velocity indirect calls. Additional Viasat source from the

signed installer was read; TPV service handlers, loaders and selected control paths were recovered.

Detailed results and coverage limits are presented in the relevant thematic sections.

2. BUSINESS CONTEXT

KVH Industries, Inc. provides mobile connectivity, satellite television, content and

network-management services. Its public company description covers commercial and leisure vessels,

land mobility and commercial applications, supported by a dealer, distributor and field-service

network.

KVH's public website also describes onboard managed IT, cybersecurity and compliance services for

maritime operations. These activities place communications equipment, network management and service

support within the company's wider business offering.

The data covers TracPhone, TracNet, TracVision, older CommBox and ICM packages, OneWeb terminal

components and software from several modem and backup-connectivity suppliers. Historical releases of

these products have their own architectures and dependencies.

3. DATASET SCALE AND STRUCTURE

The repeat source-folder check of 2 October 2026 confirmed the former register: 268 files, 66

subfolders and 40.731684275 GB. This gives 334 objects beneath D:\[Link entfernt], with 44 immediate folders

and 11 files directly at the root. The retained volume rounds to 40.73 GB. The check confirms counts

and aggregate size; byte-for-byte identity of every original file was not checked. Originals were

not modified. The separate research directories on the computer are outside this dataset.

The files are organized around equipment families, software generations, compatibility packages,

installation resources and support cases. Hxx-AC-BDU, Hxx-DC-BDU and V30 hold substantial release

sets. OneWeb and KVH-Velocity-Tool contain terminal and modem deployment packages. Older ICM/HTS

and TVRO packages contain readable application code as well as executable components.

There are 60 standard archives: 37 ZIP, 19 GZ, two RAR, one TAR and one TGZ. All passed integrity

checks. Other software deliveries use NSIS installers, FIT images, SquashFS systems, modem component

packages and nested TAR, CPIO and Debian packages.

Package contents range from compact source projects to runtime libraries and device operating-system

contents. They remain part of the retained 40.73 GB through their original packages.

Product-folder rankings use the stored deliveries; support profiles identify the files and content

contained in the relevant exports. These figures describe their stated groups and are not added into

another dataset total. Displayed file sizes use decimal MB or GB. Additional decimal places are retained for small files.

4. FILE COMPOSITION

The following figures describe the 268 files held in the source folder. A ZIP or firmware package

can contain many additional files; those contents are described in their product or support context

below.

Format Files Stored size

BIN 130 34.81 GB

GZ 19 2.26 GB

ZIP 37 1.62 GB

PKG 10 431.60 MB

EXE 5 323.12 MB

TAR 1 307.69 MB

MP4 8 200.61 MB

RAR 2 189.02 MB

KVH 16 171.37 MB

SWU 1 100.85 MB

IMG 2 94.85 MB

TIIF 3 77.06 MB

SIG 1 49.51 MB

IGS 2 42.17 MB

SLDPRT 3 22.75 MB

FW 1 13.68 MB

TGZ 1 4.77 MB

SLDASM 1 2.90 MB

SLDDRW 3 2.76 MB

PDF 7 2.63 MB

CSV 3 1.93 MB

JSON 4 1.34 MB

PHP 2 0.19 MB

DOCX 1 0.18 MB

RTF 1 0.0475 MB

CFG 3 0.013644 MB

CERT 1 0.008562 MB

TOTAL 268 40.73 GB

BIN files occupy most of the storage. The original 130 BIN files have encrypted OpenPGP

structures. Eight BIN files encountered inside OneWeb packages contain readable gzip streams.

The 16 original KVH files include older unencrypted product packages. A further UHD7 KVH package sits

inside a ZIP. PKG files supply modem software and operating systems. TIIF and FW files supply Certus

and OBi device software. The SIG and IMG files in OneWeb are structured FIT images rather than loose

text or standalone application projects.

The visible document formats include installation and service PDFs, configuration instructions,

engineering drawings and video files. Additional PowerPoint and spreadsheet resources occur inside

the parser package. Their business role is technical use and support of equipment.

5. THEMATIC COVERAGE

The categories describe business functions and information types represented by the data. Their

contents can overlap: the same file may concern a product, an installation, technical support,

account administration and a control process.

Product engineering and development: C/C++ diagnostic source, Perl and PHP communications services,

terminal web interfaces, system scripts, TypeScript interface source, supplier SDK code and

recoverable service-application logic. These materials document the implementation and integration

of equipment and communications products.

Deployment and technical operations: firmware releases, operating-system components, boot and

recovery scripts, equipment profiles, installation instructions, coverage maps and

configuration-loading tools. Their function is to establish or maintain a compatible operating state

across terminals, controllers, modems and onboard networks.

Communications charging: QuickCrew credit, vouchers, tariffs, usage limits, refills and

communications-cost models, together with related SQL definitions and reporting code.

Account administration: crew-account and address-book structures, contact fields, vessel

associations, roles, entitlement and account-migration mechanisms. These materials consist of

software models, schema fields and example forms.

Access and remote service: password-management configuration, authentication settings, embedded

service constants, SSH/SCP wrappers, VPN integration, certificate loaders, trust resources and

access-related logs.

Databases, backups and correspondence functions: populated diagnostic SQLite files; JSON and CONF

configuration backups; SQL storage and migration definitions; mail delivery, indexing, retention and

redelivery code. Interface message dictionaries are separate from email messages.

Software rights and technical controls: copyright, ownership, confidentiality and licence notices;

supplier attribution; technical service records and code for update verification, status tracking

and recovery.

Business category Confirmed content and meaning

Communications charging Credit, tariffs, vouchers, consumption models and reporting code

Account administration Crew-account and contact schema fields, roles and account-management code

Software and drawing notices Licence, copyright, ownership and confidentiality wording

Technical service controls Status records, update checks and recovery logic

Access and authentication Service constants, authentication configuration, password-management settings and PKI resources

Databases and backups Populated equipment SQLite databases, configuration backups and application SQL definitions

Mail services Mail delivery and indexing software and reference data

6. SOFTWARE DEVELOPMENT PORTFOLIO AND PROVENANCE

The development material comprises application source, delivered scripts, supplier SDKs and compiled

programs whose logic can be recovered for analysis. The unit of development is a connected product

or tool. Release variants, bundled libraries, language resources and repeated hardware

configurations are not separate products merely because they occupy different files.

Area Material represented Business function

CommBox / CBX Perl, shell, PHP, class/lib code, templates and SQL Vessel/shore communications, transfer, crew services and network administration

ICM PHP/JavaScript models and interfaces, XML transport and system scripts Terminal operation, installation, modem integration, update and recovery

TVRO / HD11 PHP/JavaScript, setup and service code, system integration Satellite television selection, receiver/LNB setup and antenna service

KVH Log File Parser Eighteen C/C++ project/build files and four supporting scripts Interpretation of terminal diagnostics and engineering output

OneWeb terminal applications Scripts, ACS TypeScript, API and telemetry definitions Component integration, antenna-service interfaces and operational data exchange

OneWeb Windows updater Compiled .NET application with reconstructed workflow and API-client logic Coordinated updates and recovery across terminal components

MaxLinear MoCA Hosted SDK, driver and operating-system support, diagnostics Integration of the coaxial-network component with the host board

Velocity Compiled Windows/macOS application with reconstructed service logic and terminal bundles Modem migration and deployment of related installation settings

Viasat Terminal Upgrader Reconstructed Java application logic, resource selections and terminal-side shell source Hardware-aware updates, intermediate releases and version validation

TPV Flash Wizard Native VB6 controller-service application and equipment profiles Firmware transfer, parameter capture and migration between controller generations

The source-text groups include 1,187 fully read CommBox contents, 306 ICM application/integration

texts, 217 TVRO/system contents and a separately reviewed HD11 web group of 119 contents. A further

HD11 backup template was read. OneWeb contributes 50 application texts and MoCA contributes 158

source/build texts. Shared content across groups retains one identity when comparing code; these

figures do not form a simple sum of independent projects.

The service applications add implementation knowledge beyond their user manuals. OneWeb exposes

five application assemblies; Viasat has 50 distinct application class contents across four

deliveries; Velocity has 32 main-package functions in each platform build; TPV has 114 identified

native procedure addresses with semantic review records. These are bounded application measures,

not counts of original source files or the implementation of all packaged firmware.

Copyright notices identify KVH and KVH Industries Norway AS in substantial parts of the terminal and

CommBox code. Virtek heritage remains in some CommBox components. Viasat and MaxLinear retain

identifiable supplier origins; OneWeb/Intellian application components and generic runtime

dependencies have their own provenance. Package possession and readability do not transfer ownership

of those components.

The material is uneven in readiness. Parser includes a recognizable source/build project; many

system components are delivered executable scripts; compiled desktop applications provide

reconstructed logic without the original development repositories. Some functions are stubs or

retain historical assumptions, and equipment behaviour has not been tested by running the supplied

programs. Upstream libraries and native ICM/TVRO, OneWeb, modem and FPGA services have not been

fully recovered.

7. COMMBOX: CONNECTIVITY AND FILE DELIVERY

CommBox is a vessel/shore communications platform represented in CBX packages for i386 and amd64.

Files carrying KVH Industries Norway AS notices appear throughout core services and transfer

components. Other files retain Virtek heritage or implement integration with external services.

The central controller, core_daemon.pl, manages the state of available communications channels. It

considers priority, connection state, scheduling, costs, limits and pending work. Carrier objects

and connectors bridge that logic to interfaces, modems, antenna services and VPN facilities.

The file-transfer subsystem maintains work through queues, priorities, delivery states, retry

decisions and result handling. Its purpose is to make delivery practical when links are intermittent

or constrained. QuickFile connects local and remote destinations using file, SMB, FTP, SFTP and mail

workflows.

The use of external bsdiff/bspatch supports transfer of changes where applicable. The

product-specific work lies in coordinating the transfer, recording state, handling interruption,

routing the result and applying usage rules. A call to a common compression or transfer utility is

not treated as a separate proprietary engine.

The transfer and mail modules document queue layout, failure handling, remote delivery conventions,

resource limits and the sequence of service operations. These details explain how the supplied

communications application coordinates delivery and handles interruptions.

The carrier model distinguishes persistent connectivity, scheduled exchange, callback and an

immediate transfer request. Driver-specific status is converted into common connection and

availability states. That separation lets the product apply shared queue and usage policy to

different communications technologies while retaining modem-specific knowledge in its connectors.

Traffic accounting links present and historical counters to day, week and month limits. The

controller uses connection cost and pending work when deciding whether an exchange is appropriate.

The related paths include usr/local/commbox/bin/core_daemon.pl, lib/carrier_object.pm and

lib/[Link entfernt], with file-transfer code under usr/local/commbox/bin/filetransfer/.

8. COMMBOX: NETWORK CONFIGURATION, CONTROL AND MONITORING

debianConf converts a shared product configuration into settings for interfaces, bridges, DHCP,

Wi-Fi, routes, DNS, firewall/QoS, mail, VPN and other services. Installation, conversion and

recovery scripts support several operating-system and hardware generations.

Quickwall and DFP coordinate firewall profiles and distribution between locations. The code includes

test application, status exchange, confirmation and restoration of the earlier configuration after a

timeout. This addresses the operational difficulty of changing connectivity remotely without

permanently losing access.

The available delivery is uneven in completeness. Some functions are stubs, some form paths are

unfinished, and several menu entries lack corresponding controllers in the packages. The vessels and

quickarchive controller directories are empty; a later encryption menu entry also has no matching

controller in the supplied TARs. Those findings limit claims that every visible screen represents an

operational feature.

The interface is connected to configuration and backend services through module handlers, internal

PHP libraries and executable templates. It includes ordinary and mobile pages for connectivity,

transfer, mail, network settings and crew access. Some application logic is stored in .conf and

html files, including configuration builders and embedded script, so the product structure is

broader than files with a conventional source-code suffix.

Logging and monitoring components retain queue status, communications usage, health and system

state. They support limited local storage, record rotation and movement of selected information to

shore. The relationship between monitoring, transport and persistent configuration is operationally

significant: the same service needs both to keep communications running and to explain interrupted

operations.

9. CREW ACCOUNTS, COMMUNICATIONS CHARGING AND USAGE

QuickCrew provides the design and implementation of a communications account system for crew. Its

code covers account creation, tariffs, credit, vouchers, time and data limits, CSV import, session

control, usage reporting and personal account screens.

The roaminguser SQL schema includes identity and contact fields, a vessel field, embark information,

account status, credit, mail usage and web usage. Migration scripts add IDT-related account fields

and change storage types as the application evolves. These are schema definitions supplied with the

software.

The schema establishes the account information model implemented by the software. The populated

SQLite databases described in this report contain equipment events and statistics.

The personal web pages expose balances, limits, refills, session start/stop and mail access.

Versions differ in their form controls, CSRF fields and handling of password-related data.

Source-level differences are recorded without treating every historical account mechanism as an

active present-day credential.

The charging logic centres on communications entitlement. Credit fields, usage amounts and

vouchers show how the software administers the service.

The transaction-log creation code defines transaction and trafficdetails tables with spending,

refill, balance, duration, consumption and domain or URL fields. Together with account state and

credit balance, these structures describe the rules for allocating and accounting for communications

services.

10. CONTACTS, CORRESPONDENCE AND MAIL SERVICES

ADDRESS BOOKS AND ACCOUNT ADMINISTRATION

The CommBox contact model supports 32 attributes, including names, display names, email, telephone,

address, company, job title, comments and a local webmail identifier. These attributes appear in the

schema and application model.

The shore hub uses MySQL field and revision records, while the v

Screenshot der Detailseite
Screenshot der Detailseite