avrora24.ru listed on Werewolves ransomware leak site

• Ransomware group: Werewolves
• Country: Russia
• Sector: Retail & E-Commerce
• Announcement date: December 20, 2023

The ransomware group known as Werewolves has officially listed the Russian-based retail and e-commerce company avrora24.ru on its leak site. According to the announcement made on December 20, 2023, the group claims to have access to sensitive information, potentially putting a significant portion of the organization's customer base at risk.

Details of the extortion attempt

The announcement from the Werewolves group outlines specific financial demands in exchange for the protection of the stolen information. The group has issued a ransom demand of 4,000 USD, which they claim is the price for the permanent deletion of the data they have acquired. This type of demand is a common tactic used by cybercriminals to exert pressure on organizations to prevent the public release of sensitive files.

In addition to the primary demand for permanent deletion, the group has presented a secondary option in their announcement. They have offered to hide the data for a period of one day for a fee of 400 USD. This tiered extortion approach is characteristic of modern ransomware operations, where attackers attempt to exploit the urgency and fear of the victim organization through varying levels of pressure.

Data involved in the claim

The announcement made by the Werewolves group makes significant claims regarding the volume of information involved in this incident. The group asserts that the data belonging to 755,369 customers may be at risk of exposure. However, it is important to note that the group has not provided a detailed breakdown regarding the exact scope or the specific types of data contained within the alleged breach.

• Customer data

About avrora24.ru

Avrora24 is a retail and e-commerce company based in Russia. The organization has established a significant presence in the market, having operated for over 10 years. The company maintains an extensive service network consisting of more than 100 branches. Avrora24 focuses on customer satisfaction and utilizes its wide network to provide services to its clientele.

Impact assessment and industry context

This incident indicates that the personal data of avrora24.ru customers may be at risk of exposure. The potential leakage of such data could lead to serious consequences for the affected individuals, including the risk of identity theft and the possibility of being targeted by sophisticated phishing attacks. Furthermore, given the organization's 10-year history and its extensive branch network, this situation could create negative impacts on its commercial reputation.

The tactics employed by the Werewolves group appear to follow the pattern of double-extortion. In a double-extortion scheme, attackers do not merely encrypt a company's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to publish the data on a public leak site, the actors attempt to maximize their ability to extract a ransom from the victim.

In the retail and e-commerce sectors, such incidents highlight the ongoing necessity for robust cybersecurity frameworks. Organizations in this sector often handle vast amounts of consumer information, making them attractive targets for threat actors. To mitigate these risks, companies typically focus on implementing multi-layered defense strategies, such as regular security audits, encryption of sensitive data at rest and in transit, and comprehensive employee training to recognize social engineering attempts. While public information about the Werewolves group remains limited, the threat of data publication remains a potent tool for extortion in the current cyber threat landscape.