Novi Pazar put ad listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Serbia
• Sector: Transportation
• Announcement date: August 19, 2023

Medusa ransomware group targets Novi Pazar put ad

The Medusa ransomware group has listed data on its leak site that it claims belongs to Novi Pazar put ad, a company based in Serbia. The announcement, made on August 19, 2023, marks a new instance of the group targeting a specific organization through its public extortion platform.

According to the claims made by the threat actors, the group is demanding a ransom of 100,000 dollars from the company. The leak site announcement includes a countdown timer and various payment options provided to the organization to prevent the disclosure of the company's data. This method is a hallmark of modern ransomware operations, where pressure is applied through time-sensitive ultimatums to compel payment.

Details of the claimed data breach

The Medusa group has provided evidence to support their claims regarding the breach. The available information includes screenshots that display samples of files which appear to be related to the company's internal operations. These samples suggest that the stolen information involves sensitive documentation necessary for the company's business functions.

The specific types of data identified in the listing include:

• Official license documents
• Technical documents

The presence of such documents in a leak site listing indicates that the attackers may have gained access to core administrative and operational files.

About Novi Pazar put ad

Novi Pazar put ad is a construction and engineering company based in Serbia. The organization operates within the infrastructure and civil engineering sectors, managing various projects related to construction and engineering works.

Analysis and potential impact of the attack

This action carried out by the Medusa group may threaten the operational continuity of the organization and lead to the disclosure of sensitive corporate information. Because the group employs a double-extortion method, the company may suffer reputational damage and be exposed to secondary cyberattacks if the data is published. In a double-extortion scenario, attackers not only encrypt systems but also steal data, threatening to leak it to pressure the victim into paying. This strategy significantly increases the risk to the victim, as even if systems are restored from backups, the threat of data exposure remains.

Furthermore, such attacks may pose risks to supply chain partners and undermine the company's credibility among its stakeholders. For an organization operating in Serbia, this incident may lead to legal obligations under local data protection regulations. The potential exposure of technical and licensing documents could disrupt business relationships and create vulnerabilities for partners who rely on the integrity of the company's documentation.

The Medusa group is a Ransomware-as-a-Service (RaaS) structure that has been active since 2021. RaaS models allow developers to lease their malware to affiliates, who then carry out the actual attacks, often leading to a higher frequency of incidents. Organizations in the construction and engineering sectors should focus on robust defensive measures to mitigate these risks. This includes maintaining rigorous backup protocols, implementing strict access controls, and ensuring continuous monitoring of network traffic to detect unauthorized data exfiltration. Strengthening supply chain security and ensuring compliance with local data protection laws are also essential steps for maintaining operational resilience against such sophisticated threats.