Business Travel Solutions listed on malas ransomware leak site

• Ransomware group: malas
• Sector: Professional Services
• Announcement date: April 9, 2023

Business Travel Solutions has been listed on the leak site operated by the ransomware group known as malas. The threat actor claims to have successfully targeted the organization, adding them to a public list of victims as part of their typical extortion operations.

The alleged attack and method of entry

According to the announcement made by the malas group, the organization was added to their victim list on April 9, 2023. The threat actor has specifically claimed that they were able to gain unauthorized access to the systems of Business Travel Solutions by exploiting a vulnerability in Zimbra software.

Ransomware groups often utilize such vulnerabilities to establish an initial foothold within a corporate network. Once access is gained, these actors typically move laterally through the environment to identify sensitive information. The use of known vulnerabilities in widely used communication or collaboration platforms, such as Zimbra, is a common tactic used by various threat actors to bypass perimeter defenses and compromise organizational integrity.

Details regarding the alleged data leak

At this stage, there is no information provided regarding the nature of the data allegedly leaked by the group. While the listing appeared on the group's platform, the specific contents of the breach remain unverified. The available evidence, such as the screenshot provided by the threat actor, shows the organization's name within a list of victims, but it does not specify the types of files or information that may have been compromised.

The listing names no specific data types.

Implications and recommended security measures

Public information regarding the malas group remains limited, making it difficult to assess the full scope of their operations or typical motivations. However, the allegation that an organization's data has been leaked can lead to a significant loss of trust among clients and business partners. Such breaches can damage professional reputations and disrupt established commercial relationships.

Depending on the content of the alleged data, legal processes under data protection regulations in the organization's operating region may be triggered. Furthermore, the leaked information could be used by threat actors for secondary attacks or targeted phishing attempts against the organization or its stakeholders. This phenomenon, often referred to as double extortion, involves threatening to release sensitive data to pressure a victim into paying a ransom.

In response to such allegations, it is advisable for the organization to conduct a thorough investigation into the alleged Zimbra vulnerability and review its overall security measures. Organizations in the professional services sector should prioritize the following defensive steps:

• Vulnerability Management: Regularly scanning for and patching known vulnerabilities in all internet-facing applications and services.
• Access Control: Implementing strict identity and access management protocols to limit the potential movement of an attacker within the network.
• Monitoring and Detection: Enhancing visibility into network traffic and system logs to identify anomalous behavior that may indicate an ongoing intrusion.
• Incident Response Planning: Maintaining and regularly testing a comprehensive incident response plan to ensure a coordinated reaction to potential breaches.

By addressing these areas, organizations can better defend against the exploitation of software vulnerabilities and mitigate the impact of potential data exfiltration attempts.