Intrama-bg listed on Stormous ransomware leak site

• Ransomware group: Stormous
• Country: Bulgaria
• Sector: Manufacturing
• Announcement date: July 28, 2024

The Stormous ransomware group has listed the Bulgarian organization intrama-bg on its dedicated leak site, alleging that the company has been the victim of a data breach. This announcement, published by the threat actor group, marks a potential escalation in the cyber threat landscape facing industrial entities in the region.

The claimed attack

According to the announcement published on July 28, 2024, the Stormous group claims to have targeted intrama-bg. The group alleges that data belonging to the organization has been compromised during the incident. While the group has made this public claim, they have not provided specific information regarding a ransom demand or the total size of the data they claim to have exfiltrated.

Ransomware attacks often follow a pattern of double extortion, where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak this data on a public forum, attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or personal information. In this instance, the group has moved to the public disclosure phase of their campaign by listing the organization on their leak site.

Details of the alleged leak

Regarding the specifics of the breach, the listing provides very limited information. The announcement does not mention the nature of the data involved, and there are no screenshots provided to substantiate the claims of the breach. The listing names no specific data types that have been compromised.

Organization profile

Intrama is a company based in Bulgaria that specializes in the manufacturing and supply of industrial equipment. Their operations include the production and distribution of machinery for food processing, packaging, and labeling. Additionally, the company provides complete packaging solutions and various consumables specifically designed for the food industry.

Analysis and implications

This incident suggests that corporate data belonging to intrama-bg may have been accessed by unauthorized parties. If a leak occurs, the exposure of sensitive information, such as employee records or trade secrets, could lead to significant reputational damage and create various operational risks for the organization. Furthermore, for entities operating within Bulgaria, the exposure of personal data may trigger data protection obligations under the General Data Protection Regulation (GDPR), which could result in potential administrative sanctions.

The Stormous group has a history of carrying out politically motivated actions. Because of this, it is possible that this incident could serve as a precursor to secondary cyberattacks or targeted phishing campaigns against the organization or its partners. Such campaigns often use stolen information to craft highly convincing messages to deceive employees or clients.

To mitigate such risks, organizations in the manufacturing and industrial sectors can implement several defensive measures. Strengthening network segmentation can help prevent attackers from moving laterally through a system. Implementing robust multi-factor authentication (MFA) across all remote access points and administrative accounts is also a critical step in preventing unauthorized access. Additionally, maintaining regular, offline backups and conducting regular security awareness training can help an organization respond more effectively to both the initial intrusion and subsequent extortion attempts.