nanoCAD listed on malas ransomware leak site

• Ransomware group: malas
• Country: Russia
• Sector: Technology
• Announcement date: April 9, 2023

nanoCAD listed on malas ransomware leak site

The technology company nanoCAD has been listed on the leak site of the ransomware group known as malas. This announcement, which appeared on the group's platform, indicates a potential data breach involving the organization.

Claims of a ransomware attack

The malas group claims to have conducted a ransomware attack against nanoCAD, listing the entity on their leak site on April 9, 2023. According to the group's assertions, the attack was facilitated by exploiting a vulnerability in Zimbra software. The group alleges that the organization's data has been compromised and suggests that the information may be published if a ransom is not paid.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not only encrypt an organization's systems to disrupt operations but also steal sensitive data. The attackers then threaten to leak this stolen information on public leak sites to pressure the victim into paying a ransom. This method increases the pressure on the target, as the threat of public exposure can lead to significant reputational damage and legal consequences.

Details regarding the compromised data

There is no detailed information regarding the nature of the compromised or threatened data. The screenshot provided by the group lists the organization's name but does not provide evidence of specific data types. The listing names no data types.

About nanoCAD

nanoCAD is a technology company that develops professional CAD (Computer-Aided Design) software for engineering and design processes. It serves the architecture and engineering sectors by providing tools and file formats compatible with AutoCAD.

Analysis and potential implications

This incident suggests that a data breach may have occurred within the organization's systems. Attacks targeting Zimbra often lead to the exposure of sensitive corporate communications and customer data through unauthorized access to email servers. This situation could potentially trigger legal proceedings under data protection regulations in the organization's operating region. Furthermore, there is a risk that the compromised data could be utilized for identity theft or targeted phishing campaigns.

Public information regarding the malas group is limited. When organizations face such threats, common defensive steps often include implementing robust patch management to address vulnerabilities in software like Zimbra, enforcing multi-factor authentication, and maintaining regular, offline backups of critical data. Monitoring for unauthorized access to email servers and implementing network segmentation are also standard practices to mitigate the impact of such breaches.