Knight ransomware group lists DIROX LTDA (Vietnã) on its leak site

• Ransomware group: Knight
• Country: Vietnam
• Sector: Technology
• Announcement date: February 1, 2024

Knight ransomware group claims data breach against DIROX LTDA

The threat actor known as Knight has listed data allegedly belonging to DIROX LTDA on its leak platform. According to the announcement made on February 1, 2024, the group claims to have compromised approximately 50 GB of data from the organization.

Details of the alleged attack

The announcement made by the Knight ransomware group involves a significant volume of information. The threat actor claims that the compromised data amounts to 50 GB in size. While the specific file count was not provided in the announcement, the scale of the breach is substantial for a technology-focused firm. The listing includes information regarding the company's role as a digital solution partner with international offices, highlighting the potential breadth of the impact.

The content of the alleged leak is quite sensitive. The threat actor claims that the stolen data includes several types of critical information, specifically:

• Banking data
• Client information
• Invoices

A screenshot provided alongside the announcement displays a browser security verification page, which is a common mechanism used to access these types of leak sites.

About DIROX LTDA

DIROX LTDA is an international technology company with over 20 years of experience. The firm specializes in providing turn-key digital solutions and operates extensively in the fields of software development and digital transformation. Due to its global operations, the company maintains a significant international presence with offices located in Vietnam, the USA, France, Japan, and Canada.

Potential impact and security implications

Given the nature of the allegedly leaked data, risks of identity theft and fraud may arise for DIROX LTDA's clients and partners. The inclusion of banking information and invoices suggests that the breach could compromise the company's supply chain security and potentially lead to secondary attacks through double extortion. Double extortion is a common tactic used by ransomware groups where, after encrypting a victim's systems, the attackers also threaten to leak sensitive data to pressure the organization into paying the ransom.

The multinational structure of DIROX LTDA may cause the impact of the leak to spread across a wide geography. Because the company maintains offices in regions such as France and Japan, legal obligations under international data protection regulations like GDPR may be triggered. Organizations operating in such a complex regulatory environment must be prepared for significant compliance and legal scrutiny following a breach.

While information about the Knight group remains limited, the incident highlights the ongoing risks faced by technology providers. For organizations in the technology and digital transformation sector, maintaining robust security protocols is essential to protect client data and maintain trust. General defensive steps for organizations typically include implementing multi-factor authentication, maintaining regular offline backups, and conducting thorough employee training to recognize phishing attempts, which are often the initial entry point for ransomware actors.