Medusa ransomware group lists BilgeAdam Software on leak site

• Ransomware group: Medusa
• Country: Türkiye
• Sector: Technology
• Announcement date: May 29, 2023

Medusa ransomware group targets BilgeAdam Software

The Medusa ransomware group has officially listed BilgeAdam Software on its leak site, claiming to have successfully exfiltrated internal data from the organization. This announcement, made on May 29, 2023, marks a significant escalation in the group's activities against the technology sector. The group has initiated a ransom demand, asserting that they have obtained sensitive information belonging to the company.

Details of the alleged attack and ransom demand

According to the claims made by the Medusa group, the breach occurred on May 29, 2023. The threat actors assert that they have acquired the company's internal source codes as well as various screenshots related to ongoing projects. This type of activity is characteristic of modern ransomware operations that utilize double-extortion tactics. In such scenarios, attackers do not merely encrypt a company's systems but also steal sensitive data to use as leverage during negotiations.

The group has issued a formal ransom demand, seeking a payment of 1,000,000 USD. This sum is requested in exchange for the group's agreement to delete the stolen data or to refrain from disclosing it to the public. The threat of releasing sensitive information publicly is a primary driver in these negotiations, putting immense pressure on the targeted organization to comply with the financial demands.

Alleged compromised data types

The information reportedly included in the leak covers several critical areas of the company's operations. The group claims to possess the following types of data:

• Source codes
• Personnel data
• Project screenshots

About BilgeAdam Software

BilgeAdam Technology is a technology company that has been operating since 1997. The organization specializes in a wide array of technical fields, including software development, IoT management, automation, communications, and network security. Furthermore, the company maintains an R&D center that has been officially approved by the Ministry of Industry and Technology.

Risk assessment and industry implications

This incident involving the Medusa group poses substantial risks to the intellectual property and the operational security of BilgeAdam Software. The alleged exposure of internal source codes is particularly concerning, as it could potentially allow malicious actors to discover vulnerabilities within the company's software products. Such a discovery could facilitate supply chain attacks, where the software provided to clients becomes a vector for further exploitation.

Additionally, the disclosure of personnel data, such as the documents appearing to be personnel schedules, increases the risk of targeted phishing attacks or identity theft directed at the company's employees. Because the organization operates within Turkey, this incident may trigger specific legal obligations, such as data breach notification requirements under the KVKK (Personal Data Protection Law).

For organizations operating in the technology sector, this event highlights the importance of robust defensive measures. To mitigate the risks associated with ransomware and data exfiltration, companies often implement strategies such as multi-factor authentication, regular security audits, and strict access controls to protect intellectual property. Given that the Medusa group has been active since 2021 and utilizes double-extortion methods, there is an assessment that they may proceed to publicly release the data if their ransom demands are not met.