Lockbit3 ransomware group lists coreengg.com on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Manufacturing
• Announcement date: February 15, 2024

The LockBit3 ransomware group has officially listed coreengg.com on its dedicated leak site. The threat actors claim to have successfully exfiltrated data from the organization, signaling a potential data breach involving sensitive corporate information.

Details of the alleged attack

According to the announcement made on February 15, 2024, the LockBit group has added coreengg.com to its public listing. In the post, the group announced its intention to publish data that they allege belongs to the firm. To support their claim, the attackers have provided samples of various financial documents that appear to be related to the company's internal operations.

The group has established a specific timeline for the potential release of this information. They have set a deadline of March 6, 2024, for the publication of the files. This type of tactic is common in ransomware operations, where a countdown is used to pressure the victim into meeting specific demands before the stolen data is released to the public.

Claimed data types

The information provided by the attackers includes screenshots of documents that appear to be linked to the financial status of the organization. The specific types of data mentioned in the listing include:

• Financial documents
• Balance sheet data
• Promissory note information

Organization profile

Core Engineering LLC is a multi-disciplinary engineering firm that was founded in 2007. Based in Texas, the company provides a wide range of professional engineering services across several states.

Risk assessment and implications

This leak claim indicates a significant risk of exposure for the organization's financial data and trade secrets. Because the entity is based in the United States, this incident may have implications regarding state-level data protection laws and potential legal obligations. The publication of such sensitive data could lead to reputational damage and create trust issues among the firm's business partners.

The LockBit group operates as a Ransomware-as-a-Service (RaaS) structure and has been tracked since 2019. Notably, the group appears to have resumed its operations despite international law enforcement actions that occurred in February 2024. This resilience highlights the ongoing challenge posed by organized cybercrime groups that continue to target various sectors.

Beyond the immediate exposure of data, there is a secondary risk associated with this incident. The leaked data could be utilized by malicious actors to conduct targeted phishing attacks against the organization's employees or its clients. Such attacks often leverage specific details found in stolen documents to increase the perceived legitimacy of the fraudulent communication.

In general, ransomware leak sites are used by threat actors as a tool for double extortion. In a double extortion scheme, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This increases the pressure on the victim to pay the ransom, as the threat of a data leak can cause long-term damage to reputation and legal standing. To defend against such threats, organizations typically implement robust security measures, such as multi-factor authentication, regular offline backups, and continuous monitoring of network traffic to detect unauthorized data exfiltration.