Lockbit3 ransomware group lists oyaksgs.com.tr on its leak site

• Ransomware group: Lockbit3
• Country: Türkiye
• Sector: Manufacturing
• Announcement date: March 15, 2024

Lockbit3 claims a massive data leak against Oyak Defense and Security Systems Inc.

The LockBit ransomware group has announced a data leak allegedly belonging to Oyak Defense and Security Systems Inc. According to the threat actor, the breach involves a significant volume of stolen information, with the group claiming to possess approximately 720 GB of data belonging to the Turkish organization.

Details of the alleged cyberattack

The LockBit group listed the domain oyaksgs.com.tr on their dedicated leak site on March 15, 2024. Through this announcement, the threat actors claim to have gained unauthorized access to the organization's data following a security incident that reportedly occurred on March 8, 2024. To support their claims of a successful intrusion, the group has provided screenshots that appear to represent various financial statements.

Ransomware groups often utilize a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive data. The threat actors then threaten to publish this stolen information on public leak sites if the ransom demands are not met. This method increases the pressure on the victim by threatening their reputation and legal standing through the exposure of confidential files.

Data types and content involved in the leak

The screenshots shared in the group's post suggest that the stolen information is highly sensitive. The content reportedly includes various financial documents, such as income-expenditure statements and detailed accounting records belonging to the organization. The specific data types identified in the leak claim include:

• Financial data
• Accounting records

While the group has provided visual evidence of these documents, they have not provided information regarding the specific file count or a specific ransom demand in their announcement.

About Oyak Defense and Security Systems Inc.

OYAK Defense and Security Systems Inc. is a Turkish company operating under the OYAK conglomerate. The company provides a wide range of specialized services, including facility security, electronic security systems, and integrated security solutions. Based in Ankara, the organization offers professional security services to both public and private sector organizations.

Strategic implications and industry risks

The alleged leak may pose a significant risk of exposing the organization's trade secrets and sensitive financial information. Given that the organization operates within the defense and security sector, the breach could lead to serious strategic and operational consequences. In highly regulated industries, the exposure of sensitive data can compromise long-term projects and operational integrity.

If the leaked data includes personal or commercial information protected under regulations such as the KVKK, the organization may face legal repercussions. Furthermore, the stolen data could potentially be utilized by malicious actors for identity theft or targeted phishing attacks against the organization's employees or partners. Such attacks often follow a breach, as the stolen information provides the necessary context to craft highly convincing social engineering campaigns.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been active since 2019. Although its infrastructure was disrupted by an international law enforcement operation in February 2024, the group has reportedly resumed operations, indicating that the group maintains its operational continuity despite previous disruptions.

To defend against such threats, organizations in the defense and security sectors typically implement layered security strategies. This includes robust access controls, continuous monitoring of network traffic, and strict data encryption protocols. Organizations also focus on employee training to recognize phishing attempts and maintain rigorous incident response plans to mitigate the impact of potential breaches.