Funksec ransomware group lists rossmanmedia.ae on its leak site

• Ransomware group: Funksec
• Country: United Arab Emirates
• Sector: Technology
• Announcement date: February 19, 2025

Funksec claims data breach against Rossman Media

The ransomware group known as Funksec has listed the digital marketing and media agency Rossman Media on its leak site. According to an announcement made on February 19, 2025, the group claims to have successfully exfiltrated data belonging to the organization, which is based in the United Arab Emirates.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's systems but also steal sensitive information, threatening to publish it publicly if their demands are not met. This method increases the pressure on companies by threatening their reputation and legal standing.

The claimed attack method and event

The Funksec group claims that the breach occurred on February 19, 2025. According to the group's announcement, the attackers gained access to the organization's environment by exploiting a vulnerability within the WordPress platform. This highlights a common trend in cyberattacks where vulnerabilities in widely used content management systems are leveraged to gain an initial foothold in a network.

By targeting software like WordPress, threat actors can often bypass traditional perimeter defenses if the software is not kept up to date or is misconfigured. Once access is achieved, attackers typically move laterally through the network to identify high-value assets, such as databases and administrative credentials, to maximize the impact of the extortion attempt.

Data involved in the alleged leak

The announcement specifies that the group claims to be in possession of approximately 700MB of data. The group alleges that this stolen information includes a variety of sensitive files and credentials that could compromise the integrity of the organization's digital infrastructure. The specific types of data claimed to be involved include:

• Backup files
• Database dumps
• SSH access keys
• Plugin credentials

The inclusion of SSH access keys and plugin credentials is particularly concerning for organizational security. SSH keys provide direct access to servers, while plugin credentials can allow attackers to manipulate the functionality of web applications. The presence of database dumps also suggests that significant amounts of structured information may have been compromised.

About Rossman Media

Rossman Media is a digital marketing and media agency located in the United Arab Emirates. The company provides a range of digital services, including social media management, content creation, and digital advertising services for various brands.

Security implications and organizational risks

The claims made by Funksec pose significant risks to the operational continuity and the security of Rossman Media's digital assets. The potential exposure of SSH keys and database dumps could facilitate secondary attacks against the organization's systems, as these credentials can be used to regain access or escalate privileges within the network.

Furthermore, information suggests that the Funksec group may utilize AI-powered tools, which may increase the likelihood of more targeted and effective attacks. As these groups evolve, their ability to automate reconnaissance and exploit vulnerabilities becomes more sophisticated. Given that Funksec emerged in late 2024, it appears their attack methods are continuing to evolve.

Organizations in the technology and digital services sector may face significant legal obligations under data protection regulations in the United Arab Emirates following such an incident. To defend against these types of threats, organizations typically implement defensive measures such as regular software patching, multi-factor authentication, and strict access controls for SSH and administrative interfaces. Monitoring for unusual data exfiltration patterns is also a critical component of a robust cybersecurity posture.