Lockbit3 ransomware group lists tjel.net on its leak site

• Ransomware group: Lockbit3
• Country: Thailand
• Announcement date: March 1, 2023

The entity tjel.net has been listed on the leak site of the LockBit ransomware group. In an announcement made on March 1, 2023, the group claimed to have obtained data belonging to the organization, marking a potential cybersecurity incident involving the Thailand-based company.

The claims made by the LockBit group

The LockBit group has announced the listing of tjel.net on its dedicated leak site. According to the announcement, the group claims to have successfully obtained data belonging to the organization. The group's announcement specifically references the company's operations within the engineering and construction sector, suggesting that the target was selected based on its industrial profile.

Ransomware groups like LockBit often utilize leak sites as a tool for double extortion. In this model, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to publish stolen data publicly, the threat actors attempt to pressure the organization into paying a ransom to prevent the exposure of confidential information. This tactic increases the pressure on the victim, as the consequences of a leak can extend far beyond immediate operational downtime.

Details regarding the alleged data breach

Despite the listing on the leak site, the group has not provided specific details regarding the content of the allegedly leaked data. There are no screenshots or specific descriptions provided to verify the nature of the stolen information. Furthermore, the group has not disclosed the total size of the data or the specific number of files involved in the claim.

• No specific data types or file categories have been identified in the listing.

When a breach occurs, the lack of immediate information regarding the data types can create significant uncertainty for the affected organization. Without knowing whether the data includes intellectual property, financial records, or personal identifiable information, organizations must prepare for various potential outcomes, ranging from regulatory scrutiny to reputational damage.

About Thai Jurong Engineering Limited

Thai Jurong Engineering Limited (TJEL) is an organization established in 1988. The company provides engineering and construction services, specifically operating within the power generation and industrial plant erection sectors. Based in Thailand, the company plays a role in large-scale industrial infrastructure projects.

Analysis and potential implications

The claims made by the LockBit group may pose risks to the operational continuity of the organization. If a data breach has occurred, the exposure of sensitive information belonging to employees or clients could lead to identity theft or targeted phishing attacks. Such attacks often follow a breach, as criminals use the stolen information to craft highly convincing messages designed to trick individuals into revealing further credentials or transferring funds.

Given that the organization is based in Thailand, it may face challenges regarding compliance with local data protection regulations. Organizations operating in highly regulated sectors, such as power generation and industrial construction, must navigate complex legal frameworks to ensure they meet all statutory requirements for data protection and incident reporting.

Considering the group's past methods, secondary actions such as the publication of data or pressure through ransom demands may be observed. LockBit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. It is reported to have resumed operations despite the disruptions in February 2024. Organizations in the engineering and construction sector can mitigate these risks by implementing robust defensive measures, such as multi-factor authentication, regular offline backups, and comprehensive employee training to recognize phishing attempts. Maintaining a strong security posture is essential for protecting industrial operations and maintaining client trust in the face of evolving ransomware threats.