ALPHV ransomware group lists data belonging to CASTGROUPCOMBR

• Ransomware group: ALPHV
• Country: Brazil
• Sector: Manufacturing
• Announcement date: July 26, 2023

ALPHV claims data breach at CASTGROUPCOMBR

The ALPHV ransomware group has listed data on its leak site that it claims belongs to CASTGROUPCOMBR. According to the threat actor, a significant volume of information was exfiltrated from the organization's network. The announcement, made on July 26, 2023, involves a massive amount of data, with the group alleging that 2 TB of information was stolen from the target.

The group has provided certain evidence to support its claims during the announcement. This includes screenshots that purport to show internal correspondence and financial statements belonging to the organization. This type of tactic is common among modern ransomware groups, who use such evidence to pressure victims into paying ransoms by demonstrating that they have successfully breached the internal network and accessed sensitive communications.

Details of the allegedly stolen data

The information allegedly leaked by the ALPHV group is extensive and covers various aspects of the organization's operations and personnel. The threat actor claims that the stolen data includes highly sensitive files that could impact both the company and its stakeholders. According to the group, the exfiltrated data consists of the following items:

• Employee personal data
• Financial reports
• Accounting records
• Customer data
• Identification documents
• Network credentials

The inclusion of network credentials is particularly significant, as such information can provide attackers with continued or elevated access to an organization's infrastructure. Furthermore, the presence of CVs, loan agreements, and various accounting records suggests a deep penetration into the company's administrative and financial systems.

Implications and risks of the alleged leak

The alleged leak of this data poses several significant risks to the organization and the individuals involved. For the employees and customers of the organization, the exposure of personal information and identification documents creates a high risk of identity theft. Additionally, the availability of such data often leads to an increase in targeted phishing attacks, where attackers use specific, stolen details to craft convincing fraudulent communications to deceive individuals.

From a business perspective, the exposure of financial reports and accounting records could potentially impact the organization's business operations and its competitive position in the market. The sensitivity of the data involved suggests a risky situation regarding the organization's operational security and its reputation management. Furthermore, if the organization is based in Brazil, the breach may trigger specific legal obligations, such as data breach notification requirements and administrative sanctions under the LGPD (Lei Geral de Proteção de Dados).

Understanding double extortion and ransomware tactics

The ALPHV group is known for employing double-extortion tactics. In a double-extortion scheme, attackers do not just encrypt a victim's data to disrupt operations; they also steal sensitive information before the encryption process begins. This allows them to threaten the victim with the public release of the data on a leak site if the ransom is not paid, effectively using the threat of data exposure as secondary leverage.

The group is also recognized for utilizing Rust-based ransomware tools, which are increasingly common in the cyber threat landscape due to the language's efficiency and security features. When organizations face such sophisticated threats, defensive strategies often include maintaining robust, offline backups, implementing strict network segmentation to prevent lateral movement, and enforcing multi-factor authentication to protect against the use of stolen credentials. Continuous monitoring and a rapid incident response plan are also critical components of a modern cybersecurity posture to mitigate the impact of such high-stakes data breaches.