LockBit 2.0 ransomware group lists radmangroup.com on its leak site

• Ransomware group: LockBit 2.0
• Country: Iran
• Sector: Professional Services
• Announcement date: April 14, 2022

LockBit 2.0 claims data breach at Radman Group

The LockBit 2.0 ransomware group has officially listed radmangroup.com on its dedicated leak site. According to the announcement, the threat actor group claims to have successfully exfiltrated data belonging to the organization. This claim was made as part of the group's broader series of cyber activities throughout the year 2022.

Details of the alleged attack

The group's announcement, posted on April 14, 2022, alleges that they have gained unauthorized access to the organization's networks. The threat actors claim that once they secured access, they were able to copy sensitive information from the victim's infrastructure. This type of activity is characteristic of modern ransomware operations, where attackers focus on data theft to increase their leverage during extortion attempts.

Ransomware leak sites serve as a public platform for these groups to pressure victims. In many cases, these groups employ a tactic known as double extortion, where they not only encrypt a company's files to disrupt operations but also steal sensitive data to threaten its public release. By listing a target on a leak site, the group signals that the victim has failed to meet their demands, potentially exposing the company to significant reputational and operational risks.

Information regarding the leaked data

Despite the claim of a successful data exfiltration, the group has not provided specific details regarding the nature of the files they allegedly stole. There is no screenshot or detailed information provided regarding the nature of the alleged leaked data. Furthermore, the listing does not specify the volume of the data or the specific types of files involved in the breach.

About Radman Group

Radman Group is an engineering, procurement, and construction (EPC) company based in Iran. The organization provides a wide range of project management and technical services, specifically serving critical sectors such as the oil, gas, petrochemical, and energy industries. Given its role in these essential sectors, the organization manages complex technical data and infrastructure-related information.

Implications and security considerations

This incident suggests that the organization's digital assets may have been subjected to unauthorized access. Although the content of the leaked data remains unclear, the exposure of corporate information could lead to secondary risks such as identity theft and targeted phishing attacks. When sensitive corporate data is leaked, attackers often use it to craft highly convincing social engineering campaigns against employees or partners.

LockBit 2.0 is a Ransomware-as-a-Service (RaaS) group that has been active since 2019. It is worth noting that the group's infrastructure was disrupted by international operations in February 2024. For organizations operating in critical sectors like energy and engineering, such breaches can lead to legal consequences under local data protection regulations and significant potential reputational damage.

To mitigate such risks, organizations in the professional services and energy sectors typically focus on strengthening their defensive postures. This includes implementing robust access controls, monitoring for unauthorized network movement, and maintaining comprehensive data encryption protocols. Organizations should also prepare for the possibility of secondary attacks, such as phishing, which often follow a data breach event.