Onubo s.r.l. listed on malas ransomware leak site

• Ransomware group: malas
• Sector: Professional Services
• Announcement date: April 9, 2023

Onubo s.r.l. targeted by malas ransomware group

Onubo s.r.l. has been listed on the leak site of the ransomware group known as malas. The announcement, which appeared on April 9, 2023, indicates that the organization's data is currently under threat of publication by the threat actors.

The claimed attack vector and event

According to the claims made by the malas group, the breach occurred on April 9, 2023. The group asserts that they were able to gain access to the systems belonging to Onubo s.r.l. by exploiting a vulnerability within the Zimbra software. This method of entry highlights a common tactic used by cybercriminals, where known or unpatched vulnerabilities in widely used software applications serve as the initial point of entry into a corporate network.

Ransomware leak sites function as a platform for extortion, where attackers post information about their victims to pressure them into paying a ransom. By listing an organization, the group signals that the victim has failed to meet their demands, thereby increasing the pressure through the threat of public data exposure. This tactic is a cornerstone of modern cyber extortion campaigns.

Information regarding the leaked data

At this stage of the incident, no information has been provided regarding the nature of the leaked or threatened data. The listing does not specify the types of files, the volume of information, or the specific datasets that may have been compromised during the alleged intrusion.

Risk assessment and implications

This incident may pose a significant risk of sensitive data being exposed or sold to third parties. When an organization is targeted in this manner, the potential consequences extend beyond the immediate technical breach. Customers and employees of the organization could become vulnerable to identity theft or targeted phishing attacks if personal information is indeed compromised. Such attacks often leverage stolen data to craft highly convincing messages designed to deceive individuals into revealing further credentials or financial information.

Furthermore, depending on the jurisdiction in which the organization operates, it may be required to comply with specific data breach notification obligations. These legal frameworks are designed to ensure that affected parties are informed of potential risks to their privacy, allowing them to take protective measures.

While information about the malas group remains limited, it is important to consider the evolving tactics of ransomware operators. Many groups currently prefer double extortion tactics, a method where attackers not only encrypt the victim's data but also steal it, threatening to release it publicly if the ransom is not paid. This dual-threat approach ensures that even if an organization can recover its systems from backups, the threat of a data leak remains a powerful lever for the attackers. Consequently, the risks associated with such a listing may persist for an extended period.

For organizations operating within the professional services sector, maintaining robust security postures is critical. This includes regular software patching to mitigate vulnerabilities like those found in Zimbra, implementing strict access controls, and maintaining comprehensive monitoring to detect unauthorized access early. Proactive defense and a clear incident response plan are essential components in managing the fallout of such cyber threats.