LockBit3 ransomware group lists melorita.com on its leak site

• Ransomware group: LockBit3
• Country: Malaysia
• Announcement date: September 25, 2022

LockBit3 claims compromise of melorita.com

The LockBit3 ransomware group has listed the domain melorita.com on its leak site. This announcement, made on September 25, 2022, serves as a claim by the threat actor group that they have successfully compromised data belonging to the organization.

In the context of modern cyber threats, ransomware leak sites are used by threat actors as a tool for extortion. These platforms often host lists of victim organizations to pressure them into paying ransoms. When a group lists a target, they are signaling that they have gained unauthorized access to the network and are threatening to release sensitive information if their demands are not met.

While the listing confirms the group's intent to publicize the incident, it is important to note that the presence of a name on a leak site is a claim made by the attackers. At this stage, the listing serves as an indicator of a potential security incident rather than a confirmed forensic conclusion.

Details of the claimed attack

The event involving melorita.com was officially announced on the LockBit3 leak site on September 25, 2022. The group asserts that they have obtained data belonging to the organization. However, the group has not provided any technical evidence to support these claims at this time.

Regarding the specifics of the breach, there is a notable lack of technical documentation from the attackers. Specifically, no evidence regarding the technical details of the attack has been provided. Furthermore, the group has not provided any screenshots to verify the contents of the alleged breach. The listing currently stands as a claim without accompanying technical validation or proof of access.

Information regarding compromised data

The listing names no specific data types or categories of information that have allegedly been exfiltrated.

About melorita.com

Melorita is a Malaysia-based human resources and payroll management solutions provider. The company offers software services that digitize personnel management, payroll, and related HR processes for businesses.

Risk assessment and organizational implications

This announcement may indicate that a vulnerability in the organization's data security processes could have occurred. When an organization specializing in human resources and payroll management is targeted, the potential impact can be significant. If the data is published, secondary risks such as identity theft or targeted phishing attacks against employees and customers may emerge.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been active since 2019. It is worth noting that the group's infrastructure was disrupted by international operations in February 2024. However, given the group's tendency to resume operations, it is assessed that such listings may potentially cause financial and reputational damage to the affected organizations.

For organizations operating in the human resources and payroll sector, maintaining robust data security is critical. Common defensive steps to mitigate such risks include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees to prevent phishing. Because these organizations handle sensitive personnel and financial information, they are often high-value targets for RaaS groups looking to maximize their extortion capabilities through double extortion tactics, where data is both encrypted and threatened with public release.