Killsec claims breach of rabitbd.com and demands ransom

• Ransomware group: Killsec
• Country: Bangladesh
• Sector: Professional Services
• Announcement date: March 21, 2024

Killsec claims a breach of rabitbd.com

The threat actor known as Killsec has announced that it has successfully breached the systems of rabitbd.com, a digital payment and financial services platform based in Bangladesh. According to the announcement made on March 21, 2024, the group is demanding a ransom of 2,000 EUR in exchange for the deletion of the allegedly stolen data. To support their claims, the group provided screenshots that purportedly show the internal management systems of the institution.

This type of activity is characteristic of modern ransomware operations, which often utilize a strategy known as double extortion. In such scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data. The threat of leaking this information publicly or selling it on the dark web serves as additional leverage to coerce the victim into paying the ransom. Ransomware leak sites serve as the primary communication channel for these groups, where they post announcements to pressure organizations into compliance.

The data involved in the alleged breach

The screenshots included in the Killsec announcement appear to display a variety of sensitive information. The leaked content reportedly includes financial and operational data that could be highly sensitive for both the institution and its users. The specific types of data mentioned in the claim include:

• Customer financial data
• Appointment records
• Operational management data

Beyond these categories, the provided screenshots specifically show details such as customer names, MAC addresses, connection times, balance information, payment history, and appointment management records. The presence of such granular data, including technical identifiers like MAC addresses and financial details like balances and payment histories, suggests a deep level of access to the organization's internal databases and management tools.

About rabitbd.com

Rabitbd is a digital payment and financial services platform based in Bangladesh. The organization provides its users with online payment processing capabilities and a variety of different financial solutions to facilitate digital transactions.

Impact and assessment of the incident

The alleged breach of rabitbd.com poses significant risks to the organization and its customers. For the customers, the exposure of personal and financial information creates a high risk of identity theft and financial fraud. Because the institution operates within the sensitive sector of payment systems, the leaked data could potentially be utilized by malicious actors to conduct highly targeted phishing attacks, using the stolen information to gain the trust of victims.

The Killsec group, which reportedly emerged in 2023 with hacktivist roots, appears to be motivated by financial gain through these types of activities. For the organization, the consequences of such a breach extend beyond immediate technical remediation. The institution may face significant legal obligations under the data protection regulations established in Bangladesh. Furthermore, the loss of customer trust and the exposure of management systems can lead to substantial and long-lasting reputational damage.

In general, organizations operating in the financial services sector can take several defensive steps to mitigate the risks associated with such breaches. Implementing robust multi-factor authentication (MFA) across all administrative and user accounts is a fundamental security measure. Additionally, maintaining strict network segmentation can help prevent attackers from moving laterally from less secure areas to critical management systems. Organizations should also prioritize continuous monitoring of their networks to detect unauthorized access early and ensure that regular, encrypted backups are maintained and tested to facilitate recovery in the event of a ransomware attack.