apt73 ransomware group lists www.certifiedinfosec.com on its leak site

• Ransomware group: apt73
• Country: United States
• Sector: Technology
• Announcement date: December 4, 2024

The threat group known as apt73 has published an announcement on its leak site claiming to be in possession of a significant data dump belonging to certifiedinfosec.com. According to the claim, the threat actor has obtained a 1.7 GB SQL database dump, allegedly extracted from the systems of the target organization. This announcement, posted on December 4, 2024, marks the beginning of a potential extortion process, as the threat actor has established a deadline for the victim.

The details of the claim

The incident involves the threat actor known as apt73, who has officially listed www.certifiedinfosec.com on their dedicated leak site. The announcement specifies that the group has acquired a 1.7 GB SQL database dump, which they claim was obtained directly from the organization's internal systems. While the specific nature of the files remains subject to the group's claims, the announcement includes a screenshot displaying a file list. This visual evidence suggests the presence of technical files that may contain database backups.

In many modern cyberattacks, threat actors utilize a method known as double extortion. In this scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to publish the stolen data on public leak sites, the attackers increase the pressure on the victim to meet ransom demands. The presence of a deadline in the apt73 announcement is a hallmark of this extortion tactic, intended to create urgency and force the target into compliance.

Data involved in the alleged breach

The announcement specifically identifies the following type of data as being in the possession of the threat actor:

• SQL database dump

The scale of the alleged theft is noted as 1.7 GB. While the exact contents of the database are not explicitly detailed in the announcement beyond the file type, the technical nature of a SQL dump suggests it may contain structured data from the organization's backend systems.

About certifiedinfosec.com

Certified Information Security (also known as Certified Tech Trainers) is an organization that provides professional training and certification services in the fields of information security, risk management, and compliance. The company offers training programs and consulting solutions aligned with various industry standards.

Risk assessment and industry implications

This incident may pose a significant risk to the organization's technical infrastructure and its customer data. As the alleged SQL database dump could contain operational data or customer information, it may lead to serious data privacy breaches. Because the organization is based in the United States, a potential data leak could result in legal consequences under various state laws and federal regulations regarding data protection and privacy.

Furthermore, the publication of such data may increase secondary risks for the organization's customers. If sensitive information is leaked, it can be utilized by malicious actors for identity theft or highly targeted phishing attacks against the individuals involved. Such attacks often leverage the specific context of the leaked data to appear more legitimate to the victim.

For organizations operating in the technology and security training sectors, maintaining robust defensive postures is critical. Common defensive steps include implementing strict access controls, ensuring regular and encrypted backups of all databases, and maintaining comprehensive logging to detect unauthorized data exfiltration. Additionally, organizations must be prepared to respond to the legal and regulatory complexities that arise when sensitive data is potentially compromised. At this time, information regarding the specific capabilities and identity of the apt73 group remains limited.