Engineered Tower Solutions listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: United States
• Sector: Professional Services
• Announcement date: December 17, 2024

Engineered Tower Solutions has been listed on the leak site of the ransomware group known as dragonforce. The group has made a claim regarding a data breach involving the organization, marking a new incident in the ongoing landscape of cyber extortion.

Details of the claimed attack

The dragonforce group has listed Engineered Tower Solutions on its leak site, claiming a data breach has occurred. This listing was discovered on December 17, 2024. According to the claims made by the threat actors, the institution was subjected to a cyberattack on December 14, 2024. By publicizing the incident on their platform, the group asserts that they have successfully obtained the institution's data.

Ransomware attacks often involve a tactic known as double extortion. In this model, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the victim into paying a ransom. These leak sites act as a public bulletin board where groups post the names of victims to damage their reputation and increase pressure.

Data involvement and information availability

Regarding the specific information that has been allegedly compromised, there is no information provided regarding the nature of the data allegedly leaked. The current listing does not specify the types of files or the volume of information involved. The available evidence, such as the screenshot associated with the claim, merely displays a verification screen used to access the group's leak site.

• No specific data types were named in the listing.

Organization profile

Engineered Tower Solutions (ETS) is a full-service engineering firm. The company provides specialized engineering services for telecommunication towers, as well as serving the residential and commercial sectors.

Impact and potential risks

This claim may lead to disruptions in the institution's operational processes and could negatively impact its corporate reputation. As a US-based institution, it may be subject to state-level data breach notification laws and relevant sectoral regulations. The uncertainty regarding the types of data involved makes it difficult to definitively assess secondary risks such as identity theft or targeted phishing attacks.

The fact that the dragonforce group has adopted a model of providing infrastructure to affiliates may suggest that their attack methods could vary. When ransomware groups operate as service providers, it often means that different affiliates may use different initial access vectors or lateral movement techniques, making the threat landscape more unpredictable for defenders.

In such scenarios, organizations typically need to initiate a comprehensive forensic investigation to verify the leak claims and determine the extent of any potential data loss. Defensive measures for professional services firms often include implementing robust endpoint detection and response, maintaining strict access controls, and conducting regular audits of network traffic to identify unauthorized data exfiltration. Because the specific data remains unknown, the organization must remain vigilant against potential follow-on attacks that leverage stolen credentials or sensitive corporate information.