Lockbit3 ransomware group lists restargp.com on its leak site

• Ransomware group: Lockbit3
• Country: Japan
• Sector: Technology
• Announcement date: December 5, 2023

LockBit3 claims data breach against Restar Holdings Corporation

The LockBit ransomware group has listed the Japan-based electronics trading company Restar Holdings Corporation on its leak site. According to the announcement made on December 5, 2023, the group claims to have accessed data allegedly belonging to the organization. This incident follows the common pattern of ransomware attacks where threat actors utilize leak sites to pressure victims through public exposure of sensitive information.

The group claims to be demanding a ransom of 2.5 million USD in exchange for the deletion or non-publication of the data. This tactic is a hallmark of double extortion, a method where cybercriminals not only encrypt an organization's systems but also steal sensitive data, threatening to release it publicly if the ransom is not paid. By using a leak site, the attackers aim to maximize psychological pressure on the target organization by threatening their reputation and operational integrity.

Details of the alleged incident

On December 5, 2023, the LockBit group listed data allegedly belonging to Restar Holdings Corporation on its leak site. The group claims to be demanding a ransom of 2.5 million USD in exchange for the deletion or non-publication of the data. To support their claims, the post includes technical documents and file lists related to the company's operational processes as samples.

The screenshots shared in the post contain technical diagrams, system configuration files, and a list of various corporate documents. Based on the information provided by the group, the following types of data are allegedly involved in the breach:

• Technical diagrams
• System configuration files
• Corporate documents

Impact and risk assessment

This action by the LockBit group may pose a risk to the company's intellectual property and trade secrets. The allegedly leaked technical documents could negatively impact the company's supply chain security and competitive advantage. Given the nature of the technical information shared as samples, the integrity of the organization's internal processes may be at risk.

Furthermore, under Japan's Act on the Protection of Personal Information (APPI), legal obligations may arise depending on the content of the leak. Additionally, given the group's past activities, the publication of the data could lead to secondary risks such as targeted phishing attacks against the company's customers and business partners. Organizations facing such threats often face a complex landscape of legal, regulatory, and reputational challenges.

Threat actor profile and defensive considerations

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. The group has shown a tendency to continue its operations despite international interventions targeting its infrastructure. Such persistent groups continue to evolve their tactics to bypass modern security perimeters.

For organizations in the technology and electronics trading sectors, maintaining robust security posture is critical. Defensive steps typically include implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits to protect intellectual property. As seen in this case, the exposure of system configuration files and technical diagrams can provide attackers with a roadmap for future exploitation, making proactive threat hunting and network segmentation essential components of a modern cybersecurity strategy.