4set.es listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: Spain
• Sector: Technology
• Announcement date: November 14, 2023

The Spanish technology firm 4set.es has been listed on the leak site of the ALPHV (BlackCat) ransomware group. The announcement, which appeared on November 14, 2023, indicates a targeted attack against the organization, with the threat actors claiming to have successfully compromised sensitive information belonging to the company.

The claimed attack and extortion tactics

According to the announcement published by the ALPHV group, the breach was identified on November 14, 2023. The threat actors behind the attack allege that 4set.es possesses various security vulnerabilities that allowed them to gain unauthorized access to the organization's systems. This claim of vulnerability is a common component of ransomware operations, where attackers seek to undermine the victim's confidence in their security posture.

The group has employed double extortion tactics in this instance. Double extortion is a sophisticated ransomware strategy where attackers do not merely encrypt a victim's data to disrupt operations, but also steal sensitive information beforehand. The attackers then threaten to release this stolen data on public leak sites if their specific demands are not met. In this case, the group has stated that if their demands are not satisfied, the alleged stolen data will be made public, thereby increasing the pressure on the victim through the threat of reputational and regulatory damage.

Alleged compromised data types

While the specific volume of the stolen data and the exact ransom amount remain unknown, the group has provided information regarding the nature of the files they claim to have exfiltrated. Based on the screenshots provided by the attackers, the alleged compromised data includes a variety of highly sensitive information categories that could impact both the company and its clients.

• Databases
• Personal data
• Confidential customer information
• Source codes

The inclusion of source codes is particularly significant for a company operating in the technology sector, as it represents the core intellectual property of the business.

Organization profile

4set is an IT and consulting company based in Spain. The organization provides a wide range of professional services to corporate clients, including IT infrastructure management, various software solutions, and technical support services. As a provider of technical services, the company serves as a critical component in the digital supply chain of its clients.

Potential impacts and industry risks

This incident may pose significant secondary risks, such as identity theft or targeted phishing attacks, for the organization's customers and employees. Because the data allegedly stolen includes personal and customer information, individuals whose data was taken may become targets for subsequent social engineering campaigns. Furthermore, as the organization operates in Spain, this breach may lead to legal consequences under the EU General Data Protection Regulation (GDPR), which mandates strict protections for personal data and imposes heavy penalties for non-compliance or failure to secure sensitive information.

For organizations in the technology sector, the loss of source code and intellectual property presents additional operational and competitive risks. The breach of such assets can lead to long-term disruptions and the potential for further exploitation of the leaked code. While there are reports suggesting that the ALPHV (BlackCat) group ceased operations as of 2024, the impacts of such leaks can persist for a long time, as stolen data remains available on the dark web or public forums.

The group known as ALPHV (BlackCat) is recognized for utilizing Rust-based malware, a programming language often chosen by developers for its performance and efficiency, which can make the malware more complex to analyze. To defend against such threats, organizations typically focus on implementing robust security frameworks, maintaining rigorous patch management to close vulnerabilities, and employing continuous monitoring to detect unauthorized access early in the attack lifecycle.