Lockbit3 ransomware group lists ascentengrs.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Professional Services
• Announcement date: March 2, 2023

Ascent Engineering has been listed on a ransomware leak site by the Lockbit3 group. The threat actor claims that the organization has been targeted in a cyberattack, asserting that data belonging to the entity has been compromised.

The claimed attack details

The Lockbit3 group published an announcement on March 2, 2023, claiming that they had successfully conducted a ransomware attack against ascentengrs.com. This listing on a leak site serves as the group's claim of a successful breach. While the group's public information remains limited, Lockbit is a known Ransomware-as-a-Service (RaaS) group that has been monitored by security researchers since 2019. It is worth noting that the group previously faced an international operation targeting its infrastructure in February 2024.

The nature of the incident involves the group's typical operational patterns. Ransomware groups often utilize leak sites to pressure victims into paying ransoms by threatening to release stolen information. This tactic is frequently associated with double extortion, a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage during negotiations.

Information regarding the leaked data

At this time, there is no information regarding the nature of the data allegedly leaked by the threat actor. The group has not provided any screenshots or specific details concerning the files they claim to have obtained. Consequently, the listing names no specific data types or file counts.

Organization profile

Ascent Engineering is an engineering and consulting firm based in Louisiana. The organization provides various engineering solutions for industrial, commercial, and public sector projects.

Risk assessment and potential implications

This incident may indicate potential vulnerabilities in the institution's data security processes. Depending on the content of the allegedly leaked data, secondary risks such as identity theft or targeted phishing attacks may arise for the institution's employees and customers. Furthermore, it is likely that legal processes will be triggered under data protection regulations in the region where the institution operates.

Considering the past activities of the Lockbit group, there is a possibility that the attack was carried out using double extortion methods. When organizations face such threats, it is often advisable to conduct a comprehensive forensic investigation to identify potential data breaches and understand the scope of the compromise. Such investigations are critical for determining exactly what was accessed and implementing necessary security improvements to prevent future occurrences.

Common defensive considerations

In the professional services sector, maintaining robust data security is vital to protecting client trust and regulatory compliance. Organizations typically focus on several key areas to mitigate these risks:

• Forensic investigation: Conducting deep dives into network logs and system states to identify the entry point and extent of the breach.
• Data protection compliance: Ensuring all data handling meets the legal requirements of the operating jurisdiction to manage potential legal liabilities.
• Phishing awareness: Preparing employees for the possibility of secondary attacks, such as targeted phishing, that often follow a data leak.
• Security posture assessment: Evaluating existing vulnerabilities that may have allowed the initial access.