BEI Srl listed on malas ransomware leak site

• Ransomware group: malas
• Sector: Professional Services
• Announcement date: April 9, 2023

BEI Srl targeted by malas ransomware group

The professional services organization BEI Srl has been listed on the leak site of a ransomware group known as malas. According to an announcement posted by the group on April 9, 2023, the organization has been targeted in a cyberattack. This listing follows the common pattern of double extortion, a tactic where threat actors not only encrypt an organization's data but also threaten to publish sensitive information on a public leak site if specific demands are not met.

Ransomware leak sites serve as a platform for these groups to exert pressure on their victims. By publishing the names of targeted organizations, these groups aim to damage the reputation of the victim and increase the likelihood of a ransom payment. Such incidents highlight the ongoing challenges faced by various sectors in defending against evolving cyber threats.

Details of the alleged attack

The malas group claims to have achieved unauthorized access to the systems belonging to BEI Srl. According to the group's announcement, the initial point of entry was achieved by exploiting a vulnerability within Zimbra software. This method of exploitation is a frequent occurrence in modern cyberattacks, as vulnerabilities in widely used communication and collaboration tools provide a significant attack surface for threat actors.

The group has stated that the data may be published if their demands are not met. While the group has made this claim, there is no detailed information regarding the nature of the data allegedly compromised. The provided screenshot associated with the announcement indicates that the institution is listed only by name, without further specifics regarding the breach's scope or the contents of the stolen files.

Data involvement

The listing names no specific data types or categories of information that have been allegedly compromised.

Risk assessment and implications

Public information regarding the malas group remains limited, making it difficult to ascertain the full extent of their operational methods. However, the claim of unauthorized access to the systems of BEI Srl poses a significant risk of sensitive corporate data exposure. If a data breach has indeed occurred, the consequences could be far-reaching for the organization.

A successful breach could negatively impact the institution's operational processes and compromise client confidentiality. Furthermore, the organization may face legal and regulatory obligations regarding data breach notifications under relevant regulations. Beyond the immediate impact of the breach, there is a secondary risk that any leaked information could potentially be utilized by threat actors in future targeted phishing attacks against the organization or its clients.

Defensive considerations for professional services

Organizations operating within the professional services sector must prioritize robust cybersecurity frameworks to mitigate these risks. Common defensive steps include maintaining rigorous patch management schedules to address vulnerabilities in software like Zimbra, implementing multi-factor authentication across all systems, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, maintaining offline, immutable backups and implementing strict network segmentation can help limit the lateral movement of attackers and ensure business continuity in the event of a successful ransomware deployment.