Bombardier Recreational Products (BRP) source codes allegedly leaked by Ransomexx

• Ransomware group: Ransomexx
• Country: Canada
• Sector: Manufacturing
• Announcement date: October 1, 2022

Ransomexx claims to have leaked BRP source code

The Ransomexx ransomware group has published what it claims to be source code belonging to Bombardier Recreational Products (BRP) on its leak site. This announcement, made on October 1, 2022, marks a significant potential breach of intellectual property for the Canadian manufacturer.

According to the group's claim, the breach involves a substantial amount of data. The group has listed files that allegedly belong to BRP, which are stated to be 788.0 MB in total. This information was released through the group's dedicated leak site, a common tactic used by ransomware actors to exert pressure on their victims.

Details of the alleged data theft

The Ransomexx group has provided various details regarding the contents of the leaked data. Based on the information provided by the group, the leak includes several critical components of the organization's digital infrastructure. The group has shared screenshots that purportedly show various sensitive elements, including Azure DevOps configurations and mobile application backends. Additionally, the leak is said to contain code snippets for various internal tools used by the company.

The data allegedly stolen includes the following items:

• Source code
• Software configuration files
• Internal application data

While the group has provided the size of the data, no information was given regarding the specific file count or the amount of a ransom demand.

About Bombardier Recreational Products (BRP)

Bombardier Recreational Products (BRP) is a Canadian company that designs, develops, and manufactures motorized recreational vehicles. Their product lineup is diverse, including snowmobiles, personal watercraft, and all-terrain vehicles. The company is a major player in the industry and owns several well-known brands, such as Ski-Doo, Sea-Doo, and Can-Am.

Security implications and organizational risks

This leak may pose significant risks to the organization's intellectual property and software security. The exposure of source code is a serious matter, as it could potentially allow attackers to identify vulnerabilities in the organization's infrastructure or facilitate supply chain attacks. Furthermore, the presence of configuration details and API keys within the leaked code may increase the risk of secondary attacks against the organization's systems.

In the broader context of cybersecurity, ransomware groups often employ a tactic known as double extortion. In this scenario, attackers do not just encrypt an organization's data to demand a ransom for decryption; they also steal sensitive information and threaten to leak it publicly if the ransom is not paid. This adds a layer of pressure, as the organization faces the threat of reputational damage and the loss of proprietary secrets.

For organizations in the manufacturing sector, such leaks can be particularly damaging due to the high value of proprietary designs and software used to operate specialized vehicles. When source code and configuration files are exposed, the security of the entire software development lifecycle can be compromised. Attackers can study the code to find flaws that allow them to bypass security controls or gain unauthorized access to internal systems.

Regarding the Ransomexx group, information about this group is limited. When faced with such incidents, it is generally advisable for organizations to promptly invalidate any credentials or configurations found in the leaked code and to conduct thorough security audits. Reviewing access logs and monitoring for unusual activity can also help in identifying if the leaked information has already been utilized by malicious actors.