apt73 ransomware group lists bg.ac.rs on its leak site

• Ransomware group: apt73
• Country: Serbia
• Sector: Education
• Announcement date: April 27, 2026

Apt73 claims to have stolen data from the University of Belgrade

The threat group known as apt73 has listed approximately 3 GB of data allegedly belonging to bg.ac.rs (University of Belgrade) on their leak site. This announcement, made on April 27, 2026, marks a significant potential breach for the prominent Serbian educational institution. The group claims to have targeted the organization on the same day the announcement was posted.

In modern cyberattack scenarios, ransomware groups often employ a tactic known as double extortion. In these instances, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The threat of releasing this stolen data on a public leak site serves as additional leverage to pressure the victim into paying a ransom. While the specific ransom demand for this incident remains unknown, the publication of data on a leak site is a common method used by such actors to demonstrate successful intrusion and increase pressure on the target.

Details of the alleged breach

The threat actor apt73 has published data they claim belongs to the institution bg.ac.rs on their leak platform. According to the group's claims, they have obtained various internal documents, correspondence, and financial reports from the university. To support these claims, the group provided screenshots in the announcement that display samples of documents that appear to be associated with the institution.

The announcement mentions several types of sensitive information that have allegedly been compromised. The specific data types identified in the listing include:

• Internal documents
• Correspondence
• Financial reports

The provided screenshots contain samples of both academic and administrative documents, which may further validate the group's claims regarding the nature of the stolen information.

About the University of Belgrade

The University of Belgrade is the oldest and largest public university in Serbia. It is a prestigious higher education institution that conducts education, research, and academic activities.

Potential impact and risks

This alleged leak may compromise the privacy of student and staff data within the university. The financial reports and correspondence claimed to be leaked could potentially be utilized for secondary attacks against the institution's operational processes. Furthermore, the publication of such data could increase risks related to targeted phishing attacks or identity theft, as attackers can use stolen details to craft highly convincing fraudulent communications.

Because the information regarding the apt73 group is limited in the public domain, the exact capabilities and motivations of the actor remain unclear. However, the impact of such a leak often extends beyond the immediate data loss. For an institution of this scale, the breach may lead to significant legal obligations under Serbian data protection regulations. Organizations in the education sector facing such threats typically focus on robust defensive measures, such as implementing multi-factor authentication, maintaining rigorous patch management, and conducting regular security awareness training to mitigate the risk of initial access through phishing.