Barid soft claims of data breach by stormous group

• Ransomware group: stormous
• Country: Iran
• Sector: Technology
• Announcement date: May 10, 2024

The stormous group has published an announcement on its leak site claiming to have compromised data belonging to the technology firm Barid soft. This announcement, which surfaced on May 10, 2024, marks the latest claim by the group regarding a successful intrusion into a corporate network.

The claims made by stormous

According to the announcement posted by the stormous group, the group claims to have gained unauthorized access to the systems of Barid soft. The group asserts that they have successfully obtained data through this breach. These allegations were shared directly by the group via their own dedicated leak site, which is a common tactic used by ransomware actors to exert pressure on their targets.

Ransomware leak sites serve as a public platform for threat actors to showcase their successful attacks. In many modern cyberattacks, groups employ a strategy known as double extortion. In this scenario, attackers do not merely encrypt a victim's files to demand a ransom for decryption; they also steal sensitive information. The threat of leaking this stolen data on a public site is used as a secondary lever to force the organization into paying the ransom, even if the organization has robust backups to restore their systems.

Details regarding the alleged data

Despite the claims made by the stormous group, there is currently no information available regarding the specific type or the content of the allegedly leaked data. Furthermore, the group has not provided any screenshots to substantiate their claims of having accessed sensitive files. The listing names no specific data types or file counts.

The organization involved

The target of this alleged attack is Barid soft, a firm operating within the technology sector. The organization is based in Iran.

Implications and defensive considerations

This incident suggests that the organization's digital assets and customer information may be at risk. Given the stormous group's politically motivated actions, the leak could potentially have negative impacts on the organization's reputation. The exposure of data may lead to secondary risks such as identity theft or targeted phishing attacks for the organization's employees and customers.

The group's past activities indicate that they use data leaks as a pressure tactic. It is important to note that public information about this group remains limited. When organizations face such threats, general defensive steps often include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to prevent initial access via phishing.

For companies in the technology sector, maintaining high standards of data governance and encryption is vital to mitigate the impact of potential leaks. The use of data leaks as a tool for political or financial leverage means that organizations must be prepared for the reputational fallout that follows an announcement on a leak site, regardless of whether the data is eventually published or not.