ICT-LabS listed on malas ransomware leak site

• Ransomware group: malas
• Sector: Technology
• Announcement date: April 9, 2023

ICT-LabS targeted by malas ransomware group

The technology firm ICT-LabS has been listed on the leak site of the malas ransomware group. The threat actor known as malas has announced the ICT-LabS institution on their leak site, claiming that an attack was carried out against the institution's systems. This announcement marks a new addition to the group's list of victims, accompanied by threats to release sensitive information.

Details of the claimed attack

According to the claims made by the malas ransomware group, the attack against ICT-LabS involved the exploitation of a vulnerability in Zimbra. The group has added the organization to their public list and is threatening to release data as part of their extortion tactics. This method is characteristic of modern ransomware operations, where attackers often employ double extortion techniques. In such scenarios, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release, thereby increasing the pressure on the victim to pay the ransom.

Ransomware leak sites serve as a platform for these groups to exert maximum psychological and reputational pressure. By listing a company on their site, the attackers aim to create visibility for the breach, hoping that the threat of public exposure will force the organization into compliance with their demands. The use of known vulnerabilities, such as those found in email server software like Zimbra, remains a common entry point for these types of malicious actors.

Information regarding compromised data

Regarding the specific contents of the alleged breach, there is no information provided regarding the nature of the compromised or threatened data. While the institution's name is listed in the screenshot provided by the attackers, no concrete evidence of specific file types or data categories has been presented. The listing names no specific data types.

Implications and organizational risks

This incident suggests that there may be a security vulnerability within the institution's systems. The reported use of a Zimbra vulnerability indicates that unpatched systems could serve as an entry point for attackers. When software vulnerabilities remain unaddressed, they provide a direct pathway for unauthorized access, potentially leading to significant breaches of confidentiality and integrity.

The potential consequences of such an incident extend beyond the immediate disruption of services. Secondary risks such as identity theft or targeted phishing campaigns may arise for the institution's clients and employees. When data is exfiltrated, the stolen information can be used to craft highly convincing social engineering attacks, targeting individuals within the organization or its customer base to gain further access or financial gain.

Furthermore, the institution's compliance with data protection regulations may lead to legal consequences depending on the scope of the potential breach. Organizations operating in the technology sector must maintain rigorous security postures to mitigate these risks. Common defensive steps for organizations include maintaining a strict patch management program to close known vulnerabilities, implementing multi-factor authentication to prevent unauthorized access, and conducting regular security audits to identify weaknesses in the infrastructure. Information about the malas group remains limited in the public domain, making it difficult to ascertain their full scope of operations.