APT73 ransomware group lists malindoair.com on its leak site

• Ransomware group: APT73
• Country: Malaysia
• Sector: Transportation
• Announcement date: January 20, 2025

APT73 claims to have breached Malindo Air

The threat actor known as APT73 has listed Malindo Air on its leak site, claiming to have successfully breached the organization's systems. According to the announcement made on January 20, 2025, the group asserts that they have accessed internal systems and obtained sensitive passenger data. This type of activity is characteristic of modern ransomware operations, where attackers often employ double extortion tactics. In such scenarios, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage, threatening to publish it on public leak sites if a ransom is not met.

The announcement posted by APT73 includes a countdown timer, a common tactic used by ransomware groups to create psychological pressure on the victim. This countdown suggests a structured process aimed at forcing a ransom demand to prevent the public disclosure of the stolen information. While the specific details regarding the ransom amount or the exact nature of the demand were not provided in the announcement, the presence of a timer and the listing on a leak site indicate an active extortion attempt.

Alleged data types involved in the leak

The information provided by the threat actor suggests a significant breach of sensitive personal information. The group claims that the stolen data includes various types of passenger information, which were reportedly captured in a tabular format as shown in screenshots provided by the attackers. The specific data points allegedly included in the leak are:

• Passenger IDs
• Names
• Reservation details
• Dates of birth
• Mobile numbers
• Passport information
• Nationality

The exposure of such high-value personal identifiers, particularly passport information and reservation details, presents a significant risk to the individuals involved. When attackers gain access to such comprehensive datasets, the information can be repurposed for various malicious activities beyond the initial extortion attempt.

About Malindo Air

Malindo Air is a Malaysia-based low-cost airline. The company provides passenger transportation services by operating regional and international flights.

Risk assessment and industry implications

This incident may increase the risk of identity theft and fraud for the institution's passengers. The allegedly leaked passport and personal data could be utilized for targeted phishing attacks, where attackers use specific details to gain the trust of victims. Such incidents in the aviation sector may trigger legal processes regarding international data protection regulations and passenger privacy policies, as airlines handle vast amounts of sensitive traveler information across multiple jurisdictions.

For organizations operating within the transportation and aviation sectors, such incidents highlight the critical importance of robust data security measures. General defensive steps for organizations facing these threats include implementing multi-factor authentication, maintaining rigorous patch management, and ensuring comprehensive encryption for data at rest and in transit. Furthermore, organizations may need to review their data security measures and notify affected passengers to mitigate potential harm. Public information regarding the specific capabilities and history of the APT73 group remains limited, making it difficult to assess the full scope of their operational patterns.