BE.iT SA listed on leak site by malas

• Ransomware group: malas
• Sector: Professional Services
• Announcement date: April 9, 2023

BE.iT SA listed on leak site by malas

The threat actor known as malas has listed the professional services organization BE.iT SA on their leak site. This announcement, published on April 9, 2023, indicates that the group claims to have targeted the institution in a cyberattack.

The claims made by the malas group

According to the announcement published on their leak site, the malas group claims to have targeted BE.iT SA. The group states that they gained access to the institution's systems by exploiting a Zimbra vulnerability. This method of entry highlights how vulnerabilities in widely used software can be leveraged by threat actors to penetrate organizational networks.

In many ransomware scenarios, threat actors utilize known vulnerabilities to establish an initial foothold within a network. Once access is gained, they may attempt to escalate privileges or move laterally through the environment to identify sensitive assets. In this specific instance, the group's claim centers on the exploitation of the Zimbra platform to achieve their objectives.

Information regarding the leaked data

Regarding the content of the alleged breach, the group has not provided any specific details regarding data samples or ransom demands related to this institution. The listing does not provide information regarding the nature of the leaked data, the total size of the data, or the specific file count involved in the incident.

• No specific data types were named in the listing.

In the landscape of modern cyber extortion, groups often employ a tactic known as double extortion. This involves not only encrypting an organization's data to disrupt operations but also threatening to leak sensitive information on public forums if a ransom is not paid. While the malas group has claimed access, they have not yet released or detailed the specific content of any data they may have exfiltrated.

Implications and organizational risks

This incident suggests that the institution's digital assets may have been subjected to unauthorized access. The use of Zimbra vulnerabilities may indicate that the institution could be at risk due to outdated software infrastructure. Maintaining up-to-date software is a critical defensive step for organizations to mitigate the risk of exploitation via known vulnerabilities.

If a data breach has occurred, it may pose secondary risks such as identity theft or targeted phishing attacks for the institution's clients and employees. Furthermore, depending on the region where the institution operates, a potential data breach could trigger legal processes under relevant data protection regulations. Organizations must remain vigilant and follow established incident response protocols to manage such risks.

Public information about the malas group remains limited. For organizations operating in the professional services sector, maintaining robust security postures, implementing regular patch management, and monitoring for unauthorized access are essential components of a comprehensive cybersecurity strategy. Such measures help protect against the various stages of a cyberattack, from initial exploitation to the eventual threat of data exposure.