Evropoly listed on malas ransomware leak site

• Ransomware group: malas
• Sector: Manufacturing
• Announcement date: April 9, 2023

Evropoly targeted by malas ransomware group

The manufacturing organization Evropoly has been listed on the leak site operated by the ransomware group known as malas. This announcement, made on April 9, 2023, marks a significant development in the ongoing threat landscape facing the manufacturing sector. While the listing serves as a claim by the threat actor, it highlights the persistent risks posed by specialized ransomware groups targeting industrial entities.

The claimed attack and methodology

According to the announcement made by the malas group, the threat actors claim to have successfully gained access to the internal systems of Evropoly. The group has explicitly stated that they utilized vulnerabilities within Zimbra software to facilitate this unauthorized access. This method of exploitation is a common tactic used by various threat actors to bypass security perimeters and establish a foothold within a corporate network.

Following the alleged breach, the group has issued threats to publish the organization's data. This tactic is a hallmark of double extortion ransomware campaigns. In such scenarios, attackers do not merely encrypt data to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to release stolen data on public leak sites, the attackers aim to pressure the victim into meeting ransom demands to prevent the exposure of proprietary or sensitive information.

Details regarding the alleged data breach

At this stage, there is no information regarding the nature of the leaked or threatened data. The screenshot provided by the group shows the organization's name listed on their platform, but no specific details regarding the content of the data have been provided. Furthermore, there is no information available regarding the total size of the data or the specific file count involved in this incident.

• No specific data types have been identified in the listing.

The lack of specific details regarding the volume or type of data makes it difficult to assess the immediate impact of the breach. However, the mere presence of an organization on a leak site creates significant uncertainty for the affected entity.

Risks and industry implications

Public information regarding the malas group remains limited, making it difficult to attribute specific patterns or long-term objectives to this particular actor. Nevertheless, the alleged access to Evropoly's systems poses a potential risk of exposing sensitive manufacturing data or employee information. In the manufacturing sector, the exposure of such data can lead to the loss of intellectual property, trade secrets, and operational blueprints.

The use of Zimbra vulnerabilities suggests that the organization may be susceptible to similar threats if there is an outdated software infrastructure. Maintaining up-to-date software and implementing rigorous patch management are essential defensive steps for any organization to mitigate the risk of exploitation through known vulnerabilities. Failure to secure perimeter software can provide an open door for attackers to move laterally through a network.

If the data is eventually published, the organization could face significant harm to its commercial reputation. Additionally, such an event could trigger administrative processes under relevant data protection regulations. Beyond the immediate regulatory and reputational consequences, there is a secondary risk that the leaked data could be utilized by malicious actors for targeted phishing attacks against the organization or its partners. Organizations in this sector should prioritize robust monitoring, employee awareness training, and comprehensive incident response plans to defend against these evolving threats.