Etisalat.ae targeted by Lockbit3 ransomware group

• Ransomware group: Lockbit3
• Country: United Arab Emirates
• Sector: Professional Services
• Announcement date: February 16, 2024

Lockbit3 claims to have compromised etisalat.ae

The Lockbit3 ransomware group has published a leak announcement on its platform, claiming to have compromised data belonging to etisalat.ae. This announcement, posted on February 16, 2024, marks a significant claim against the major telecommunications provider, as the group threatens to release the institution's data if their demands are not met.

The group has officially listed etisalat.ae on its leak site, asserting that they have successfully breached the organization's network. In the announcement, the threat actors have issued a ransom demand of 100,000 USD. This type of extortion is a hallmark of modern ransomware operations, often referred to as double extortion, where attackers not only encrypt a victim's systems but also threaten to leak sensitive information to pressure the organization into paying.

Details of the alleged breach and data involved

According to the claim made by Lockbit3, the group has obtained various materials from the institution's network. The announcement includes several screenshots intended to prove the validity of the breach. These visual proofs allegedly show various file directories and technical diagrams that were extracted from the organization's internal environment.

The content of the provided screenshots appears to include technical documentation and diagrams that are related to the organization's infrastructure. Specifically, the leaked materials include:

• File directories
• Technical diagrams
• Technical documentation related to infrastructure

The listing names no specific data types or individual file counts, providing only the visual evidence mentioned above to support their claims.

About etisalat.ae

Etisalat by e& is a multinational telecommunications company based in the United Arab Emirates. As one of the world's largest mobile network operators, it provides a wide range of services, including voice, data, and various digital services to a massive user base.

Potential implications and security context

This claim poses a significant risk to the institution's operational continuity and data privacy. The technical documents allegedly leaked could potentially serve as a foundation for further, more advanced attacks against the institution's network infrastructure. When technical diagrams and infrastructure documentation are exposed, they provide a roadmap that malicious actors can use to identify vulnerabilities and navigate the network more effectively.

The threat actor involved, Lockbit, is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Notably, the group is reported to have resumed its operations following an international disruption of its infrastructure in February 2024. The resilience of such groups poses a constant challenge to global cybersecurity efforts.

Given the organization's prominent position in the telecommunications sector, a potential data breach carries heavy implications. Such an incident could impact customer privacy and, due to the critical nature of telecommunications, could have broader implications for national security. Organizations in this sector typically focus on robust network segmentation, continuous monitoring, and strict access controls to mitigate these risks. Protecting infrastructure documentation is a critical component of maintaining a strong defensive posture against sophisticated threat actors.