Nok Air listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: Thailand
• Sector: Transportation
• Announcement date: July 26, 2023

The Thailand-based airline company Nok Air has been listed on the leak site of the ALPHV ransomware group. The threat actors behind the listing claim to have compromised a significant amount of data belonging to the transportation provider.

The alleged attack and claims by ALPHV

The ALPHV (also known as BlackCat) group has announced that it has allegedly compromised 500 GB of data belonging to Nok Air. According to the threat actors, the attack is linked to a specific timeframe, with the claimed attack date set for November 20, 2022. The announcement was made on the group's leak site on July 26, 2023.

The group has issued a threat to the organization, stating that if the company does not contact them within one week, the stolen data will be published. To support their claims of a successful breach, the group has shared screenshots of the allegedly compromised data. While these images are intended to prove the validity of the intrusion, they serve as a tool of pressure in the ongoing extortion attempt.

Data involved in the alleged breach

While there is no clear information regarding the specific content of the allegedly compromised data, the group has provided some visual evidence through screenshots. These images show various folder structures and financial accounts. However, the listing does not provide a comprehensive list of specific data types or individual files that were targeted during the operation.

Organization profile

Nok Air is a low-cost airline based in Thailand. It operates both domestic and regional flights using Don Mueang International Airport as its main hub.

Impact and assessment of the threat

This alleged leak could potentially damage the company's operational continuity and customer trust. If the data is published, the disclosure of passengers' personal information and the emergence of secondary risks such as identity theft may occur. Furthermore, the company may face legal sanctions under Thailand's data protection regulations.

The ALPHV group is known as an entity that uses malware developed in the Rust language and adopts double extortion methods. In a double extortion scheme, attackers do not only encrypt a victim's data to disrupt operations but also steal sensitive information to threaten its public release. This method increases the pressure on organizations to pay the ransom, as the threat of data exposure can lead to significant reputational and legal consequences.

In the transportation sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Organizations in this sector often manage vast amounts of sensitive passenger information, making them high-value targets for sophisticated threat actors. To mitigate such risks, companies typically focus on implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees. Additionally, maintaining offline backups and implementing network segmentation can help limit the lateral movement of malware within a corporate environment.

Information about the ALPHV group remains limited in the public domain, making it difficult to track their full scope of operations or specific evolving tactics beyond their known use of Rust-based malware and double extortion techniques.