malas ransomware group lists ТрансКом-Авиа on its leak site

• Ransomware group: malas
• Country: Russia
• Sector: Transportation
• Announcement date: April 9, 2023

TransKom-Avia listed on malas ransomware leak site

The Russian-based aviation and logistics services company, TransKom-Avia, has been listed on the leak site associated with the malas ransomware group. This announcement, made by the threat actor, indicates an alleged data breach involving the organization.

Details of the alleged attack

According to the claim made by the threat actor known as malas on April 9, 2023, the group targeted TransKom-Avia. The group asserts that they gained access to the organization's network by exploiting a vulnerability within Zimbra software. Following the initial access, the entity was subsequently listed on the group's leak site, which implies an alleged exfiltration of data from the victim's environment.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers do not only encrypt an organization's systems to disrupt operations but also steal sensitive information. The threat of releasing this data publicly serves as additional leverage to pressure the victim into paying a ransom. While the presence of a company on a leak site is a significant indicator of a potential security incident, it remains an allegation made by the threat actor.

Data and information status

Regarding the specifics of the incident, there is no detailed information available concerning the content of the leaked data. The listing provided by the group serves as a confirmation of their claim but does not specify the nature of the files involved. The provided screenshot associated with the announcement displays the group's list of victims, but the listing names no specific data types.

Organization profile

TransKom-Avia is a company based in Russia that operates within the aviation and logistics services sector. The organization's primary business activities include air cargo transportation and the provision of related logistics solutions.

Potential impact and industry considerations

The alleged data breach involving TransKom-Avia could lead to significant disruptions in business operations and may cause damage to various organizational processes. Furthermore, the potential exposure of sensitive information could create secondary risks for both customers and employees, including threats such as identity theft or targeted phishing attacks.

The incident may also trigger legal obligations for the organization under the data protection regulations that are applicable within its specific region. For organizations operating in the transportation and logistics sectors, maintaining robust security postures is critical due to the high value of supply chain data. Common defensive steps for organizations include implementing rigorous patch management to address vulnerabilities in software like Zimbra, enforcing multi-factor authentication, and maintaining comprehensive backups to mitigate the impact of encryption-based attacks.

Public information regarding the malas group remains limited, making it difficult to establish a comprehensive profile of their specific tactics, techniques, and procedures beyond the current claim. As with many ransomware incidents, the lack of transparency from the threat actor necessitates a cautious approach to assessing the full scope of the impact.