Model Engineering listed on cicada3301 ransomware leak site

• Ransomware group: cicada3301
• Country: United Arab Emirates
• Sector: Manufacturing
• Announcement date: September 24, 2024

The cicada3301 ransomware group has listed the United Arab Emirates-based firm Model Engineering on its leak site. The threat actor group claims to have successfully breached the organization's networks, leading to a significant data leak involving a large volume of sensitive information.

The claimed attack and data leak

According to the announcement posted on the group's leak site on September 24, 2024, the cicada3301 group claims to have gained unauthorized access to the institution's networks. The group asserts that the breach occurred on September 23, 2024. The total volume of the data allegedly exfiltrated is reported to be 111 GB, consisting of approximately 20,175 files.

The group has provided evidence to support its claims by publishing screenshots of various files and folder structures. These visual proofs are stated to be directly related to the architectural and engineering projects managed by the firm. While the group has provided these screenshots, public information regarding the specific identity and operational details of the cicada3301 group remains limited.

Data types and affected information

The screenshots shared by the threat actor group suggest a wide variety of sensitive documentation has been compromised. The leaked content appears to include critical intellectual property and internal operational data. The specific types of data identified in the leak include:

• Architectural and engineering project files
• Technical calculations
• Project management correspondence
• Backup data

The presence of such diverse file types, including architectural drawings in DWG and PDF formats, system directories, and technical calculations, indicates a deep level of access into the organization's file servers and project management systems.

About Model Engineering

Model Engineering is a design and project development firm that has been operating since 1972. The organization specializes in the fields of architecture and engineering, providing a comprehensive range of services. Their project portfolio is diverse, covering high-rise towers, luxury homes, infrastructure planning, and various industrial facilities.

Impact assessment and industry implications

The alleged leak of the institution's intellectual property and ongoing projects may pose significant risks to its commercial competitiveness. In the highly specialized fields of architecture and engineering, the loss of proprietary designs and technical calculations can undermine a firm's unique market position. Furthermore, if the leaked data contains customer information or contractual details, the institution could face potential legal liabilities toward third parties.

Beyond the immediate loss of data, such breaches often lead to secondary risks. The exposure of sensitive correspondence and project details may increase the likelihood of employees and business partners being targeted by sophisticated phishing attacks. Additionally, the release of technical data could potentially weaken the security of the broader supply chain associated with these large-scale projects.

In response to such incidents, organizations operating within the United Arab Emirates may need to fulfill necessary notifications and inform affected parties within the framework of local data protection regulations. Generally, when organizations face ransomware-related data leaks, they must consider the implications of double extortion, a tactic where attackers not only encrypt data but also threaten to publish it to pressure the victim into paying a ransom. Defensive measures for organizations in this sector typically involve robust network segmentation, rigorous access controls, and comprehensive employee training to mitigate the risk of initial access and lateral movement by threat actors.