Cactus ransomware group lists newagesys.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Technology
• Announcement date: March 22, 2024

Cactus ransomware group claims data theft from New Age Systems

The Cactus ransomware group has officially listed New Age Systems on its leak site, claiming to have successfully exfiltrated a significant amount of sensitive information. According to the announcement made on March 22, 2024, the threat actor group asserts that they have obtained 319 GB of data belonging to the organization. This claim follows an alleged attack date of February 29, 2024, marking a period of unauthorized access and data exfiltration by the group.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. This process frequently involves a tactic known as double extortion, where attackers not only encrypt a victim's systems to disrupt operations but also steal sensitive data to threaten its public release. By publishing stolen information, the attackers aim to maximize their leverage, causing both operational disruption and significant reputational damage to the targeted entity.

Details of the claimed data exfiltration

The data allegedly stolen by the Cactus group is extensive and appears to cover a wide range of sensitive corporate and personal information. Based on the group's claims, the leaked dataset includes various critical documents that could pose significant risks if disseminated. The information reportedly encompasses a variety of files that touch upon the core administrative and personal aspects of the organization and its workforce.

The specific types of data mentioned in the leak include:

• Accounting documents
• Payroll and tax records
• HR data
• Personal Identifying Information (PII)
• Passport details
• Driver's license details
• Corporate correspondence

Furthermore, the group has provided screenshots as evidence of the breach, which reportedly show highly sensitive items such as passports, driver's licenses, and financial balance sheets. The inclusion of such personal identifying information (PII) and financial records highlights the severity of the alleged breach, as these documents are highly valuable for identity theft and other fraudulent activities.

About New Age Systems

New Age Systems is a technology company headquartered in Princeton, New Jersey. The organization specializes in providing a variety of software solutions and consulting services. Their expertise covers critical business functions, including enterprise resource planning (ERP), accounting, and payroll management services.

Analysis and potential impact of the breach

The Cactus group, which emerged in 2023, is known for gaining network access typically by exploiting vulnerabilities in Virtual Private Networks (VPNs). Such vulnerabilities often serve as an entry point for attackers to penetrate corporate perimeters and move laterally through a network. For a technology company providing software and consulting services, a breach of this nature can have far-reaching consequences.

The disclosure of this data may pose secondary risks to the organization's employees, specifically regarding the potential for identity theft and highly targeted phishing attacks. Because the stolen data includes personal identifiers like passports and driver's licenses, individuals may face increased risks of sophisticated social engineering attempts. Additionally, the disclosure of financial data may create risks regarding the exposure of trade secrets.

Given that the organization is based in the United States, this incident may lead to legal consequences under both state laws and federal regulations regarding data protection and privacy. Organizations in the technology and service sectors often face significant challenges following such incidents, including the need to navigate complex regulatory landscapes and manage the fallout of reputational damage. To mitigate such risks, organizations generally focus on strengthening VPN security, implementing multi-factor authentication, and maintaining robust data encryption protocols to protect sensitive information from unauthorized exfiltration.