- Gruppe
- Everest
- Erfassungsdatum
- Status
- Online / unverändert
- Land
- Vereinigte Staaten
Hinweise zur Einordnung
Dieser Eintrag dokumentiert eine Veröffentlichung der Gruppe. Ein Angriff oder Datenabfluss ist damit nicht unabhängig bestätigt.
Konfidenz ist eine heuristische Einschätzung. Prüfzeitpunkte beziehen sich auf die Anreicherung, nicht auf unabhängige Verifikation. Herkunft und Korrekturen finden Sie unter „Firmeninformationen & Datenherkunft“.
Angaben der Ransomware-Gruppe
UnbestätigtQuellentext als öffentliche Metadaten wiedergegeben. Die Aussagen wurden nicht unabhängig geprüft; Links sind ausgeblendet.
[Link entfernt] 41 GB DataBase
1. EXECUTIVE SUMMARY
The data consists of satellite-terminal software, communications-platform source code, firmware
releases, engineering drawings, commissioning resources, support tools and operational diagnostics.
It covers KVH TracPhone, TracNet and TracVision equipment alongside components supplied by OneWeb,
Intellian, MaxLinear, iDirect, Newtec, Viasat, Iridium and other providers.
The folder holds 268 files and 66 subfolders, occupying 40.73 GB. Its 60 standard archives contain
software packages, source files, configuration sets and support exports. Firmware images account for
much of the stored volume; readable application code is also embedded in older product packages.
The substantive software findings include KVH Log File Parser 4.72, the ICM and TVRO web/control
layers, and a substantial CommBox application platform. CommBox contains interconnected functions
for selecting communications channels, transferring files over intermittent links, handling mail,
managing crew accounts, controlling usage, configuring networks and reporting vessel status to
shore.
The OneWeb material includes application scripts, recoverable TypeScript for the ACS interface, API
descriptions, telemetry schemas and a MaxLinear MoCA software development kit. The kit includes
C/C++, Linux driver support, operating-system abstractions, diagnostics and board-specific
adaptations. The compiled OneWeb and Viasat updaters also provide recoverable client logic for
component updates, compatibility checks and service recovery. Supplier code and integration changes
have separate provenance from explicitly marked KVH code. Velocity exposes a modem-conversion
workflow on Windows and macOS; TPV Flash Wizard exposes native controller-transfer and
parameter-preservation logic.
The operational records include 11 SQLite databases, terminal configurations, incident exports,
antenna logs and a substantial radio-signal time series. Their contents connect equipment events,
network conditions, antenna state and navigation-related fields to service cases.
The material reveals product architecture, message formats, service procedures, deployment settings
and technical operating conditions. Some source code is incomplete or dependent on external
binaries. The 131 stored encrypted firmware files, plus two encrypted SWU files inside Thales
packages, retain an explicit boundary on knowledge of their internal contents.
Support materials cover PVT Emerald, PVT Venus, Tanusha, JANA 508, Intellian AIM incidents and
Excelerate Energy - Shenandoah. MY Reverie contains installation settings and satellite coverage
data. These materials include equipment configurations and records of its operation.
The data contains implementation details, service access settings, device configurations,
operational history and resources for individual installations. Supplier libraries, reference
schemas and blank service forms are also present.
The follow-up of 2 October 2026 closed the former queues for PVT Venus images, visual video content,
internal TV8 CAD, OneWeb resources and Velocity indirect calls. Additional Viasat source from the
signed installer was read; TPV service handlers, loaders and selected control paths were recovered.
Detailed results and coverage limits are presented in the relevant thematic sections.
2. BUSINESS CONTEXT
KVH Industries, Inc. provides mobile connectivity, satellite television, content and
network-management services. Its public company description covers commercial and leisure vessels,
land mobility and commercial applications, supported by a dealer, distributor and field-service
network.
KVH's public website also describes onboard managed IT, cybersecurity and compliance services for
maritime operations. These activities place communications equipment, network management and service
support within the company's wider business offering.
The data covers TracPhone, TracNet, TracVision, older CommBox and ICM packages, OneWeb terminal
components and software from several modem and backup-connectivity suppliers. Historical releases of
these products have their own architectures and dependencies.
3. DATASET SCALE AND STRUCTURE
The repeat source-folder check of 2 October 2026 confirmed the former register: 268 files, 66
subfolders and 40.731684275 GB. This gives 334 objects beneath D:\[Link entfernt], with 44 immediate folders
and 11 files directly at the root. The retained volume rounds to 40.73 GB. The check confirms counts
and aggregate size; byte-for-byte identity of every original file was not checked. Originals were
not modified. The separate research directories on the computer are outside this dataset.
The files are organized around equipment families, software generations, compatibility packages,
installation resources and support cases. Hxx-AC-BDU, Hxx-DC-BDU and V30 hold substantial release
sets. OneWeb and KVH-Velocity-Tool contain terminal and modem deployment packages. Older ICM/HTS
and TVRO packages contain readable application code as well as executable components.
There are 60 standard archives: 37 ZIP, 19 GZ, two RAR, one TAR and one TGZ. All passed integrity
checks. Other software deliveries use NSIS installers, FIT images, SquashFS systems, modem component
packages and nested TAR, CPIO and Debian packages.
Package contents range from compact source projects to runtime libraries and device operating-system
contents. They remain part of the retained 40.73 GB through their original packages.
Product-folder rankings use the stored deliveries; support profiles identify the files and content
contained in the relevant exports. These figures describe their stated groups and are not added into
another dataset total. Displayed file sizes use decimal MB or GB. Additional decimal places are retained for small files.
4. FILE COMPOSITION
The following figures describe the 268 files held in the source folder. A ZIP or firmware package
can contain many additional files; those contents are described in their product or support context
below.
Format Files Stored size
BIN 130 34.81 GB
GZ 19 2.26 GB
ZIP 37 1.62 GB
PKG 10 431.60 MB
EXE 5 323.12 MB
TAR 1 307.69 MB
MP4 8 200.61 MB
RAR 2 189.02 MB
KVH 16 171.37 MB
SWU 1 100.85 MB
IMG 2 94.85 MB
TIIF 3 77.06 MB
SIG 1 49.51 MB
IGS 2 42.17 MB
SLDPRT 3 22.75 MB
FW 1 13.68 MB
TGZ 1 4.77 MB
SLDASM 1 2.90 MB
SLDDRW 3 2.76 MB
PDF 7 2.63 MB
CSV 3 1.93 MB
JSON 4 1.34 MB
PHP 2 0.19 MB
DOCX 1 0.18 MB
RTF 1 0.0475 MB
CFG 3 0.013644 MB
CERT 1 0.008562 MB
TOTAL 268 40.73 GB
BIN files occupy most of the storage. The original 130 BIN files have encrypted OpenPGP
structures. Eight BIN files encountered inside OneWeb packages contain readable gzip streams.
The 16 original KVH files include older unencrypted product packages. A further UHD7 KVH package sits
inside a ZIP. PKG files supply modem software and operating systems. TIIF and FW files supply Certus
and OBi device software. The SIG and IMG files in OneWeb are structured FIT images rather than loose
text or standalone application projects.
The visible document formats include installation and service PDFs, configuration instructions,
engineering drawings and video files. Additional PowerPoint and spreadsheet resources occur inside
the parser package. Their business role is technical use and support of equipment.
5. THEMATIC COVERAGE
The categories describe business functions and information types represented by the data. Their
contents can overlap: the same file may concern a product, an installation, technical support,
account administration and a control process.
Product engineering and development: C/C++ diagnostic source, Perl and PHP communications services,
terminal web interfaces, system scripts, TypeScript interface source, supplier SDK code and
recoverable service-application logic. These materials document the implementation and integration
of equipment and communications products.
Deployment and technical operations: firmware releases, operating-system components, boot and
recovery scripts, equipment profiles, installation instructions, coverage maps and
configuration-loading tools. Their function is to establish or maintain a compatible operating state
across terminals, controllers, modems and onboard networks.
Communications charging: QuickCrew credit, vouchers, tariffs, usage limits, refills and
communications-cost models, together with related SQL definitions and reporting code.
Account administration: crew-account and address-book structures, contact fields, vessel
associations, roles, entitlement and account-migration mechanisms. These materials consist of
software models, schema fields and example forms.
Access and remote service: password-management configuration, authentication settings, embedded
service constants, SSH/SCP wrappers, VPN integration, certificate loaders, trust resources and
access-related logs.
Databases, backups and correspondence functions: populated diagnostic SQLite files; JSON and CONF
configuration backups; SQL storage and migration definitions; mail delivery, indexing, retention and
redelivery code. Interface message dictionaries are separate from email messages.
Software rights and technical controls: copyright, ownership, confidentiality and licence notices;
supplier attribution; technical service records and code for update verification, status tracking
and recovery.
Business category Confirmed content and meaning
Communications charging Credit, tariffs, vouchers, consumption models and reporting code
Account administration Crew-account and contact schema fields, roles and account-management code
Software and drawing notices Licence, copyright, ownership and confidentiality wording
Technical service controls Status records, update checks and recovery logic
Access and authentication Service constants, authentication configuration, password-management settings and PKI resources
Databases and backups Populated equipment SQLite databases, configuration backups and application SQL definitions
Mail services Mail delivery and indexing software and reference data
6. SOFTWARE DEVELOPMENT PORTFOLIO AND PROVENANCE
The development material comprises application source, delivered scripts, supplier SDKs and compiled
programs whose logic can be recovered for analysis. The unit of development is a connected product
or tool. Release variants, bundled libraries, language resources and repeated hardware
configurations are not separate products merely because they occupy different files.
Area Material represented Business function
CommBox / CBX Perl, shell, PHP, class/lib code, templates and SQL Vessel/shore communications, transfer, crew services and network administration
ICM PHP/JavaScript models and interfaces, XML transport and system scripts Terminal operation, installation, modem integration, update and recovery
TVRO / HD11 PHP/JavaScript, setup and service code, system integration Satellite television selection, receiver/LNB setup and antenna service
KVH Log File Parser Eighteen C/C++ project/build files and four supporting scripts Interpretation of terminal diagnostics and engineering output
OneWeb terminal applications Scripts, ACS TypeScript, API and telemetry definitions Component integration, antenna-service interfaces and operational data exchange
OneWeb Windows updater Compiled .NET application with reconstructed workflow and API-client logic Coordinated updates and recovery across terminal components
MaxLinear MoCA Hosted SDK, driver and operating-system support, diagnostics Integration of the coaxial-network component with the host board
Velocity Compiled Windows/macOS application with reconstructed service logic and terminal bundles Modem migration and deployment of related installation settings
Viasat Terminal Upgrader Reconstructed Java application logic, resource selections and terminal-side shell source Hardware-aware updates, intermediate releases and version validation
TPV Flash Wizard Native VB6 controller-service application and equipment profiles Firmware transfer, parameter capture and migration between controller generations
The source-text groups include 1,187 fully read CommBox contents, 306 ICM application/integration
texts, 217 TVRO/system contents and a separately reviewed HD11 web group of 119 contents. A further
HD11 backup template was read. OneWeb contributes 50 application texts and MoCA contributes 158
source/build texts. Shared content across groups retains one identity when comparing code; these
figures do not form a simple sum of independent projects.
The service applications add implementation knowledge beyond their user manuals. OneWeb exposes
five application assemblies; Viasat has 50 distinct application class contents across four
deliveries; Velocity has 32 main-package functions in each platform build; TPV has 114 identified
native procedure addresses with semantic review records. These are bounded application measures,
not counts of original source files or the implementation of all packaged firmware.
Copyright notices identify KVH and KVH Industries Norway AS in substantial parts of the terminal and
CommBox code. Virtek heritage remains in some CommBox components. Viasat and MaxLinear retain
identifiable supplier origins; OneWeb/Intellian application components and generic runtime
dependencies have their own provenance. Package possession and readability do not transfer ownership
of those components.
The material is uneven in readiness. Parser includes a recognizable source/build project; many
system components are delivered executable scripts; compiled desktop applications provide
reconstructed logic without the original development repositories. Some functions are stubs or
retain historical assumptions, and equipment behaviour has not been tested by running the supplied
programs. Upstream libraries and native ICM/TVRO, OneWeb, modem and FPGA services have not been
fully recovered.
7. COMMBOX: CONNECTIVITY AND FILE DELIVERY
CommBox is a vessel/shore communications platform represented in CBX packages for i386 and amd64.
Files carrying KVH Industries Norway AS notices appear throughout core services and transfer
components. Other files retain Virtek heritage or implement integration with external services.
The central controller, core_daemon.pl, manages the state of available communications channels. It
considers priority, connection state, scheduling, costs, limits and pending work. Carrier objects
and connectors bridge that logic to interfaces, modems, antenna services and VPN facilities.
The file-transfer subsystem maintains work through queues, priorities, delivery states, retry
decisions and result handling. Its purpose is to make delivery practical when links are intermittent
or constrained. QuickFile connects local and remote destinations using file, SMB, FTP, SFTP and mail
workflows.
The use of external bsdiff/bspatch supports transfer of changes where applicable. The
product-specific work lies in coordinating the transfer, recording state, handling interruption,
routing the result and applying usage rules. A call to a common compression or transfer utility is
not treated as a separate proprietary engine.
The transfer and mail modules document queue layout, failure handling, remote delivery conventions,
resource limits and the sequence of service operations. These details explain how the supplied
communications application coordinates delivery and handles interruptions.
The carrier model distinguishes persistent connectivity, scheduled exchange, callback and an
immediate transfer request. Driver-specific status is converted into common connection and
availability states. That separation lets the product apply shared queue and usage policy to
different communications technologies while retaining modem-specific knowledge in its connectors.
Traffic accounting links present and historical counters to day, week and month limits. The
controller uses connection cost and pending work when deciding whether an exchange is appropriate.
The related paths include usr/local/commbox/bin/core_daemon.pl, lib/carrier_object.pm and
lib/[Link entfernt], with file-transfer code under usr/local/commbox/bin/filetransfer/.
8. COMMBOX: NETWORK CONFIGURATION, CONTROL AND MONITORING
debianConf converts a shared product configuration into settings for interfaces, bridges, DHCP,
Wi-Fi, routes, DNS, firewall/QoS, mail, VPN and other services. Installation, conversion and
recovery scripts support several operating-system and hardware generations.
Quickwall and DFP coordinate firewall profiles and distribution between locations. The code includes
test application, status exchange, confirmation and restoration of the earlier configuration after a
timeout. This addresses the operational difficulty of changing connectivity remotely without
permanently losing access.
The available delivery is uneven in completeness. Some functions are stubs, some form paths are
unfinished, and several menu entries lack corresponding controllers in the packages. The vessels and
quickarchive controller directories are empty; a later encryption menu entry also has no matching
controller in the supplied TARs. Those findings limit claims that every visible screen represents an
operational feature.
The interface is connected to configuration and backend services through module handlers, internal
PHP libraries and executable templates. It includes ordinary and mobile pages for connectivity,
transfer, mail, network settings and crew access. Some application logic is stored in .conf and
html files, including configuration builders and embedded script, so the product structure is
broader than files with a conventional source-code suffix.
Logging and monitoring components retain queue status, communications usage, health and system
state. They support limited local storage, record rotation and movement of selected information to
shore. The relationship between monitoring, transport and persistent configuration is operationally
significant: the same service needs both to keep communications running and to explain interrupted
operations.
9. CREW ACCOUNTS, COMMUNICATIONS CHARGING AND USAGE
QuickCrew provides the design and implementation of a communications account system for crew. Its
code covers account creation, tariffs, credit, vouchers, time and data limits, CSV import, session
control, usage reporting and personal account screens.
The roaminguser SQL schema includes identity and contact fields, a vessel field, embark information,
account status, credit, mail usage and web usage. Migration scripts add IDT-related account fields
and change storage types as the application evolves. These are schema definitions supplied with the
software.
The schema establishes the account information model implemented by the software. The populated
SQLite databases described in this report contain equipment events and statistics.
The personal web pages expose balances, limits, refills, session start/stop and mail access.
Versions differ in their form controls, CSRF fields and handling of password-related data.
Source-level differences are recorded without treating every historical account mechanism as an
active present-day credential.
The charging logic centres on communications entitlement. Credit fields, usage amounts and
vouchers show how the software administers the service.
The transaction-log creation code defines transaction and trafficdetails tables with spending,
refill, balance, duration, consumption and domain or URL fields. Together with account state and
credit balance, these structures describe the rules for allocating and accounting for communications
services.
10. CONTACTS, CORRESPONDENCE AND MAIL SERVICES
ADDRESS BOOKS AND ACCOUNT ADMINISTRATION
The CommBox contact model supports 32 attributes, including names, display names, email, telephone,
address, company, job title, comments and a local webmail identifier. These attributes appear in the
schema and application model.
The shore hub uses MySQL field and revision records, while the v
