Lockbit3 ransomware group lists aicsacorp.com on its leak site

• Ransomware group: Lockbit3
• Country: Guatemala
• Announcement date: October 3, 2023

LockBit claims data theft against AICSA Corp

The LockBit ransomware group has officially listed the domain aicsacorp.com on its dedicated leak site. According to the announcement made on October 3, 2023, the threat actor group claims to have gained unauthorized access to the organization's systems and intends to publish data allegedly belonging to the company. This development follows a pattern of double extortion, a tactic where ransomware groups not only encrypt an organization's data but also threaten to leak sensitive information on public platforms to increase pressure for ransom payments.

The group has initiated a countdown process, a common psychological tactic used by ransomware operators to create a sense of urgency and pressure the victim into meeting their demands before the stolen information is released to the public. While the group has announced its intent to publish the data, the specific nature of the breach remains a matter of the group's claim.

Details of the claimed data breach

Regarding the scope of the alleged intrusion, the LockBit group has provided limited specific details. The group claims that the volume of data stolen is approximately 200 GB. This information relates to the company's operations, though the specific files or databases targeted have not been identified by the attackers in their initial announcement.

The listing does not specify the type of data involved; it only states that the total data size is 200 GB. Consequently, no specific file types or categories of information have been identified at this time.

About AICSA Corp

AICSA Corp. is a firm based in Guatemala. The organization provides a variety of professional services to both its local and international clients, including consulting, engineering, construction, and project delivery services.

Impact assessment and security considerations

The claim made by LockBit could have significant implications for the organization. Such a leak may create negative impacts on the company's operational continuity and its commercial reputation. Depending on the actual content of the shared data, secondary risks such as identity theft or targeted phishing attacks may be observed if sensitive information belonging to employees or clients is eventually exposed.

Furthermore, due to the organization's international business partnerships, its data security standards may be questioned. The organization is also subject to the data protection regulations applicable in Guatemala. For firms operating in the engineering and construction sectors, maintaining the integrity of project data and client information is vital for maintaining trust with global partners.

LockBit is a well-known ransomware group that has been active since 2019. The group operates under the Ransomware-as-a-Service (RaaS) model, which allows different affiliates to use their infrastructure to carry out attacks. Although the group's infrastructure was disrupted in February 2024, it has been observed that they continue their activities. Organizations facing such threats often focus on defensive strategies such as robust backup management, multi-factor authentication, and continuous monitoring to mitigate the risks posed by these persistent threat actors.