Cactus ransomware group lists ammega.com on its leak site

• Ransomware group: Cactus
• Country: Netherlands
• Sector: Manufacturing
• Announcement date: March 11, 2024

The Cactus ransomware group has listed the Netherlands-based manufacturing company ammega.com on its leak site. The threat actors claim to have gained access to the organization's networks, alleging that they have compromised a massive volume of sensitive information totaling approximately 850 GB.

The claimed attack and ransom demands

According to the announcement made on March 11, 2024, the Cactus group asserts that they successfully breached the organization's network. The group claims that the breach occurred around February 16, 2024. Through this unauthorized access, the attackers allege they have obtained a wide range of documents spanning multiple critical business functions, including accounting, human resources, engineering, and legal departments.

The threat actors are employing a double extortion tactic, a method where attackers not only encrypt an organization's data but also threaten to publish sensitive information on a public leak site to increase pressure. In this specific instance, the group is demanding a ransom of $9,000,000 USD to prevent the publication of the stolen data. Additionally, the group has set a separate price of $90,000 for the release of the file tree.

Alleged data contents

The data allegedly stolen by the Cactus group is extensive and covers various aspects of the company's operations. The group claims the stolen information includes:

• Accounting and tax records
• Employee payrolls and personal files
• Customer projects and contracts
• Technical drawings and R&D documents
• Legal correspondence and non-disclosure agreements
• Executive management data

The group has provided screenshots as evidence of the breach, which reportedly show examples of sensitive documents such as passports and non-disclosure agreements.

Organization profile

Ammega is a global manufacturing company that specializes in conveyor belts and power transmission solutions. The company is involved in the development of high-performance belts and technical textile products designed for various industrial applications.

Potential impact and security implications

The alleged breach carries significant risks for the organization and its stakeholders. For employees and customers, the exposure of personal files and payroll information could lead to risks of identity theft and targeted phishing attacks. Furthermore, because the organization is based in the Netherlands, a confirmed breach could result in legal proceedings and administrative sanctions under the General Data Protection Regulation (GDPR).

The use of double extortion by the Cactus group poses a threat to the company's reputation and could lead to the exposure of valuable trade secrets if the data is released. The group has stated that they exploited VPN vulnerabilities to gain access to the network, which suggests that the organization may need to conduct a thorough review of its current cybersecurity measures and remote access protocols.

Additionally, the sensitivity of the data involved may create indirect risks for the organization's supply chain partners. In the manufacturing sector, the loss of engineering drawings and technical documents can disrupt the trust and operational security of partners who rely on the integrity of the company's intellectual property. To defend against such threats, organizations often implement multi-factor authentication, conduct regular vulnerability assessments, and maintain robust backup strategies to ensure business continuity.