Lockbit3 ransomware group lists pbw-india.com on its leak site

• Ransomware group: Lockbit3
• Country: India
• Sector: Professional Services
• Announcement date: July 31, 2024

The LockBit ransomware group has officially listed the organization pbw-india.com on its dedicated leak site. This announcement, recorded on July 31, 2024, indicates a potential data breach involving the entity, though the claim remains an assertion by the threat actor group.

The details of the claim

According to the announcement posted on the group's leak platform, the LockBit group claims that the data belonging to pbw-india.com has been compromised. While the announcement was recorded in late July 2024, the group has claimed that the attack itself took place on December 4, 2022. This discrepancy in dates is a common occurrence in ransomware extortion scenarios, where the time of initial intrusion may differ significantly from the time the threat actor chooses to publicize the victim's name.

LockBit is a known Ransomware-as-a-Service (RaaS) entity that has been active in the cyber threat landscape since 2019. Although international law enforcement operations successfully disrupted the group's infrastructure in February 2024, reports indicate that the group has since resumed its operations. Such groups typically utilize a double extortion model, where they not only encrypt an organization's systems but also exfiltrate sensitive data to use as leverage during ransom negotiations.

Information regarding the alleged leak

At this stage, there is no information available regarding the specific nature or content of the alleged leaked data. The listing provided by the threat actor includes a screenshot that displays the verification screen of the leak site, but it does not provide a breakdown of the stolen files. The listing names no specific data types.

In many ransomware incidents, the lack of immediate information regarding the data content is a standard phase of the extortion process. Threat actors often withhold specific details to increase pressure on the victim, intending to publish more granular information if their demands are not met. This uncertainty creates a challenging environment for incident responders who must determine the scope of the exposure without immediate forensic evidence from the attacker.

About Patel Brass Works

Patel Brass Works (PBW) is an established industrial entity based in Rajkot, India. Founded in 1948, the company has a long history in the manufacturing sector. It specializes in the production of brass castings and various related metal products, serving as a specialized manufacturer within the industrial landscape.

Risk assessment and organizational implications

The claim of a data leakage poses several secondary risks to the organization and its stakeholders. If the alleged stolen data is published, it could lead to identity theft or facilitate highly targeted phishing attacks directed at the company's employees and customers. These types of social engineering attacks often leverage specific organizational details to gain further access to internal systems or to defraud clients.

Furthermore, the organization may face significant legal obligations under Indian data protection regulations following a breach of this nature. Organizations in the professional services and manufacturing sectors often face complex regulatory requirements regarding the protection of client information and industrial intellectual property.

To mitigate the risks associated with such threats, organizations typically focus on robust defensive measures. These include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize phishing attempts. Additionally, maintaining offline, immutable backups is a critical component of a resilient cybersecurity posture to ensure business continuity in the event of a successful ransomware deployment.

• Potential for future publication: Given the known tactics of the LockBit group, there remains a possibility that the alleged stolen data could be published in the future.