malas ransomware group lists ФГУП “ЦНИИХМ” on its leak site

• Ransomware group: malas
• Country: Russia
• Sector: Manufacturing
• Announcement date: April 9, 2023

The malas group claims responsibility for targeting FGUP TSNIIKHM

The threat actor group known as malas has listed the organization FGUP TSNIIKHM on its dedicated leak site. According to an announcement published by the group on April 9, 2023, the organization has been targeted in a cyberattack. The listing serves as a public claim by the threat actors regarding their involvement in a breach affecting the Russian entity.

This type of activity is characteristic of modern ransomware operations, where threat actors use leak sites to pressure victims. These sites function as a platform for extortion, where groups post information about their targets to increase the pressure on the victimized organization to meet their demands.

Details of the claimed attack and exploit method

The malas group claims to have gained access to the systems of FGUP TSNIIKHM by exploiting a vulnerability within the Zimbra software. This method of entry highlights a common tactic used by cybercriminals, where unpatched or vulnerable software serves as the initial access vector for infiltrating secure networks.

While the group has announced the attack, they have implied that they may demand a ransom by threatening to publish the organization's data. This approach is a hallmark of double extortion tactics. In these scenarios, attackers do not merely encrypt files to disrupt operations; they also steal sensitive information to use as leverage. The threat of a public data leak is used to coerce the organization into paying a ransom to prevent the exposure of their internal information.

Data involved in the incident

Regarding the specifics of the breach, the listing provides no details regarding the nature of the allegedly leaked data. No information has been provided concerning the volume of files or the specific categories of data that may have been compromised during the incident.

About FGUP TSNIIKHM

FGUP TSNIIKHM (Central Scientific Research Institute of Chemistry and Mechanics) is a Russian state research institute. The organization is responsible for developing chemical products and ammunition technologies specifically for the defense industry. It operates under the authority of the Ministry of Industry and Trade of the Russian Federation.

Implications and defensive considerations

This incident may result in the exposure of the organization's sensitive data. The use of Zimbra vulnerabilities suggests that there may be weaknesses in the organization's network infrastructure. If the data is published, the organization's commercial reputation and operational security could be negatively affected. Furthermore, if the leaked data contains employee or customer information, it could lead to secondary risks such as identity theft and targeted phishing attacks.

For organizations operating in high-stakes sectors like defense and manufacturing, such incidents underscore the importance of robust patch management. Ensuring that software, particularly communication and collaboration tools like Zimbra, is kept up to date is a critical defensive step to prevent exploitation of known vulnerabilities.

Additionally, organizations must consider the broader impact of data exposure. Beyond the immediate operational disruption, the loss of sensitive research or personnel information can lead to long-term consequences. Maintaining strong network segmentation and implementing rigorous monitoring can help detect unauthorized access attempts before they escalate into full-scale data exfiltration. Publicly available information regarding the specific capabilities and history of the malas group remains limited, making it difficult to predict their specific patterns beyond these claims.