Preference Portugal listed on malas ransomware leak site

• Ransomware group: malas
• Sector: Retail & E-Commerce
• Announcement date: April 9, 2023

Preference Portugal targeted by malas ransomware group

The ransomware group known as malas has officially listed the organization Preference Portugal on its leak site. This announcement, made on April 9, 2023, indicates that the institution has been targeted in a cyberattack. While the listing serves as a public claim by the threat actor, it highlights an ongoing trend where ransomware groups use leak sites to pressure victims through public exposure.

Claims of exploitation via Zimbra vulnerability

According to the claims made by the malas group, the attack against Preference Portugal's systems was successfully executed by utilizing a vulnerability in Zimbra. This type of exploitation often targets email or collaboration software to gain an initial foothold within a corporate network. By leveraging known or unknown vulnerabilities in such software, attackers can bypass traditional perimeter defenses to access sensitive internal environments.

The group has explicitly threatened to publish the data belonging to the institution if their demands are not met. This tactic is a hallmark of modern cyber extortion, where the threat of data exposure is used as a primary lever to coerce the victim into fulfilling ransom requirements.

Details regarding the leaked data

At this stage, the announcement provides no specific information regarding the nature or the volume of the leaked or threatened data. There is no mention of the total file count or the specific types of files that may have been accessed during the intrusion. The listing remains vague concerning the exact contents of the breach.

Affected data categories

• No specific data types were identified in the listing.

Analysis and potential implications

Public information regarding the malas group remains limited, making it difficult to attribute specific patterns or long-term motivations to this particular actor. However, the potential leak of Preference Portugal's data presents significant secondary risks. For customers and employees, such a breach can lead to identity theft or the deployment of highly targeted phishing attacks, as attackers may use stolen information to craft convincing social engineering schemes.

Given that the organization operates within the retail and e-commerce sector, the potential exposure of customer information may trigger significant legal obligations. Organizations in this sector are subject to various data protection regulations that mandate the privacy and security of consumer data, and a breach of this nature often necessitates formal reporting and compliance procedures to mitigate legal and regulatory consequences.

This incident appears to follow the double extortion method, a common strategy used by ransomware groups. In this model, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to release this data publicly, the group aims to increase the pressure on the institution to make payments, effectively using the threat of reputational damage and regulatory fines as a tool for extortion.

To defend against such threats, organizations typically focus on robust patch management to close vulnerabilities in software like Zimbra, implementing multi-factor authentication, and maintaining rigorous data encryption protocols. Continuous monitoring and a well-tested incident response plan are also essential for mitigating the impact of such targeted attacks.