Lockbit3 ransomware group lists catalyst-group.co.nz on its leak site

• Ransomware group: Lockbit3
• Country: New Zealand
• Sector: Professional Services
• Announcement date: December 19, 2022

LockBit3 claims data breach at Catalyst Group

The LockBit ransomware group has announced the listing of catalyst-group.co.nz on its dedicated leak site. This announcement marks a significant development for the New Zealand-based organization, as the threat actor claims to have successfully compromised the entity's digital infrastructure.

Details of the alleged attack

According to the announcement made on December 19, 2022, the LockBit group claims to have gained unauthorized access to the networks belonging to catalyst-group.co.nz. The group asserts that this access was used to perform data exfiltration, a process where sensitive information is moved from the victim's environment to a location controlled by the attacker. This technique is a hallmark of modern ransomware operations, often used to increase leverage during extortion attempts.

Since the initial announcement on the leak platform, no further information regarding the current status of the organization or the specific circumstances of the breach has been provided. The lack of updates following the initial claim leaves the full extent of the impact unconfirmed.

Information regarding the leaked data

At this stage, the threat actor has not provided specific details regarding the nature of the allegedly leaked data. There is no screenshot provided to verify the contents, nor is there a detailed list outlining the specific types of files or information that were targeted during the exfiltration process. Consequently, the exact scope of the data involved remains unknown.

Potential risks and implications

The listing suggests the possibility that the organization's commercial data and client information may have been compromised. If the data is eventually published on the leak site, several secondary risks could emerge. These include the potential for identity theft or the execution of targeted phishing attacks directed at the organization's clients and employees. Such attacks often leverage stolen information to gain further access or to conduct fraudulent activities.

About Catalyst Group

Based in New Zealand, Catalyst Group is a multi-disciplinary firm operating in the design and construction sector. The organization provides its clients with a wide range of services, including end-to-end solutions or tailored single-service solutions to meet specific project requirements.

Threat actor profile and industry context

The LockBit group is a known threat actor that has been operating since 2019 using the Ransomware-as-a-Service (RaaS) model. This model allows developers to lease their ransomware code to affiliates, who then carry out the actual attacks. While the group's infrastructure was disrupted by international operations in February 2024, reports indicate that the group has since resumed its activities.

For organizations in the professional services sector, such incidents highlight the importance of robust cybersecurity frameworks. Because these firms often handle sensitive client data and complex project details, they are frequent targets for extortion-based attacks. In the event of a confirmed breach, organizations must navigate various legal processes and notification obligations under local privacy laws, particularly in jurisdictions like New Zealand where data protection regulations are strictly enforced.

To mitigate such risks, organizations typically focus on defensive measures such as implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular network monitoring to detect unauthorized access early. Furthermore, maintaining offline backups and establishing a clear incident response plan are critical steps in managing the fallout of a potential ransomware event.