Gitlabs: Acqua development, QBurst, Pamyra.de targeted by fog ransomware group

• Ransomware group: fog
• Sector: Technology
• Announcement date: February 16, 2025

The threat actor known as fog has listed data allegedly belonging to Acqua development, QBurst, and Pamyra.de on its leak site. This announcement, which surfaced on February 16, 2025, marks a significant potential breach involving multiple entities within the technology sector.

The details of the claim

The fog group published an announcement on February 16, 2025, claiming responsibility for the incident. According to the post, the group has targeted three specific entities: Acqua development, QBurst, and Pamyra.de. The announcement includes torrent links intended for accessing the claimed datasets. Each of these data packages is stated to be 7 GB in size, contributing to a total claimed data size of 21 GB across the three organizations.

Crucially, the threat actor implies that these datasets were obtained directly from Gitlab repositories. While the group has provided the links and the size of the files, there is no detailed information provided regarding the specific nature or the exact contents of the leaked material. The claim suggests a targeted extraction from development environments rather than a general network intrusion.

The data involved

While the specific file contents remain unverified and the group has not provided granular details, the announcement points toward the exfiltration of sensitive development assets. The listing identifies the following types of affected data:

• Source code
• Software development data

The presence of such information in a leak site typically indicates that the attackers have moved beyond simple encryption and have successfully exfiltrated intellectual property from the target's infrastructure.

Analysis and potential impact

This incident may pose significant risks to the intellectual property and the software development lifecycles of the affected entities. If the leaked data indeed includes source code, it could potentially lead to the discovery of vulnerabilities in the organizations' products, which could facilitate sophisticated supply chain attacks. Such attacks occur when a trusted provider is compromised, allowing attackers to distribute malicious code to the provider's downstream customers.

Furthermore, the publication of this data may result in significant reputational damage for the affected parties. Ransomware actors typically employ double extortion tactics, a method where they not only encrypt an organization's data to disrupt operations but also threaten to leak the stolen information publicly to pressure the victim into paying a ransom. This dual-threat approach increases the pressure on organizations to comply with demands to avoid public exposure.

From a regulatory perspective, the breach may trigger legal proceedings under GDPR or similar data protection regulations, depending on the specific jurisdictions in which the affected organizations operate. Organizations in the technology sector facing such threats often focus on hardening their repository access controls, implementing multi-factor authentication for all development tools, and enhancing monitoring of data exfiltration patterns to mitigate the risk of future incidents.