3Punto6 listed on malas ransomware leak site

• Ransomware group: malas
• Sector: Professional Services
• Announcement date: April 9, 2023

3Punto6 targeted by malas ransomware group

The professional services organization 3Punto6 has been listed on the leak site associated with the ransomware group known as malas. This announcement, made on April 9, 2023, indicates that the group claims to have successfully targeted the institution's systems.

Ransomware groups often utilize leak sites to exert pressure on their victims. These platforms serve as a public gallery for compromised organizations, where the threat actors post names and sometimes samples of stolen data to coerce the victim into paying a ransom. This tactic is a hallmark of double extortion, where attackers not only encrypt a company's data but also threaten to release it publicly to maximize their leverage.

Claims of exploitation via Zimbra vulnerability

According to the announcement made by the malas group, the attack on 3Punto6 was carried out by exploiting a vulnerability within Zimbra. This specific type of exploitation suggests that the attackers may have gained unauthorized access to the institution's email infrastructure. By targeting email servers, threat actors can often intercept sensitive communications and gain a foothold within a corporate network.

The group has issued threats to publish the institution's data if their demands are not met. While the group has made these claims on their platform, the specific details regarding the method of entry and the subsequent movement within the network remain limited to the mention of the Zimbra vulnerability. In many such cyberattacks, once an initial entry point is established through a known vulnerability, attackers work to escalate privileges and move laterally through the network to locate high-value assets.

Details regarding the alleged data breach

Regarding the information that has been allegedly compromised, there is no detailed information available regarding the nature of the data. The listing does not specify the types of files, the volume of data, or the specific categories of information that the group claims to have exfiltrated.

• No specific data types were named in the listing.

Potential risks and organizational implications

Because public information regarding the malas group is limited, the full scope of the threat remains difficult to assess. However, the use of a Zimbra vulnerability implies that the attackers may have had access to internal correspondence and potentially sensitive customer information. If the data is indeed published, it could lead to secondary risks for both the institution's employees and its customers, such as identity theft or the execution of targeted phishing attacks.

For organizations in the professional services sector, such incidents carry significant weight. The potential exposure of internal communications can damage professional relationships and erode client trust. Furthermore, depending on the region where the institution operates, such a breach may trigger legal obligations regarding data breach notifications and could result in potential legal sanctions.

To defend against such threats, organizations typically focus on robust patch management to close vulnerabilities like those found in email servers. Implementing multi-factor authentication, maintaining strict network segmentation, and conducting regular security audits are also common defensive measures used to mitigate the risk of unauthorized access and lateral movement by ransomware groups.