Lockbit3 targets siren-japan.com in new ransomware extortion attempt

• Ransomware group: Lockbit3
• Country: Japan
• Sector: Technology
• Announcement date: May 22, 2023

Lockbit3 claims to have breached siren-japan.com

The Lockbit3 ransomware group has officially listed the Japanese organization siren-japan.com on its dedicated leak site. According to the announcement made on May 22, 2023, the threat actors claim to have gained unauthorized access to the company's systems and are now threatening to publish the organization's data if their demands are not met.

This incident follows the common pattern of double extortion, a tactic frequently employed by modern ransomware groups. In such scenarios, attackers do not merely encrypt a victim's files to disrupt operations; they also exfiltrate sensitive information. The threat actors then use the leverage of a potential data leak to pressure the victim into paying a ransom, threatening to release the stolen information on a public leak site to cause maximum reputational and legal damage.

The ransom demand and the threat of publication

The Lockbit3 group has issued a specific ransom demand in relation to this incident. The threat actor is demanding a payment of 300,000 USD to prevent the publication of the organization's data. The group has indicated that the data will be made public if the ransom is not paid within the specified deadline provided by the attackers.

While the group has made these claims, it is important to note that these are assertions made by the threat actor on their leak site. The group, which has been active since 2019 and operates under a Ransomware-as-a-Service (RaaS) model, continues to carry out these types of operations. Although international law enforcement operations disrupted the group's infrastructure in February 2024, reports indicate that they continue their criminal activities.

Details regarding the claimed data breach

At this stage, the specific details regarding the content of the leaked data have not been provided by the attackers. No specific information has been released concerning the volume of files or the exact size of the data stolen during the breach.

However, based on the nature of the organization's business, it is anticipated that the stolen information may contain sensitive data related to the organization's design projects and business partnerships. The listing names no specific data types in a formal list, but the potential exposure of such information remains a significant concern for the entity involved.

Organization profile: Siren

Siren is a design agency based in Japan that specializes in creating graphic designs and visual content for various entertainment genres. Their expertise covers a wide range of creative fields, including movies, plays, dramas, and music. The agency focuses on creating a dramatic world view that appeals to emotions within a single graphic space, serving a variety of clients within the entertainment sector.

Potential impact and organizational risks

This incident may pose a significant risk of exposing the organization's trade secrets and customer data. For a Japan-based entity like Siren, a potential data breach could trigger complex legal processes under the APPI (Act on the Protection of Personal Information). Such regulatory frameworks are designed to protect individual privacy, and a breach of this nature often necessitates formal reporting and legal scrutiny.

Beyond the immediate legal implications, the organization may face substantial reputational damage. If the data is published, the company could suffer from a loss of trust among its clients and business partners. Furthermore, there are significant risks of secondary attacks, where criminals use the leaked information to conduct further phishing campaigns or identity theft against the organization or its clients.

To mitigate such risks, organizations in the technology and creative sectors can implement various defensive measures. These include robust data encryption, strict access controls, and regular security audits. Maintaining a comprehensive incident response plan and ensuring that all employees are trained in cybersecurity awareness are also critical steps in defending against the evolving tactics of ransomware groups like Lockbit3.