RansomHub ransomware group lists prasarana.com.my on its leak site

• Ransomware group: RansomHub
• Country: Malaysia
• Sector: Transportation
• Announcement date: August 26, 2024

RansomHub claims attack on Prasarana Malaysia Berhad

The RansomHub ransomware group has listed the Malaysian transportation provider Prasarana Malaysia Berhad on its dedicated leak site. This announcement, made on August 26, 2024, serves as a public claim by the threat actor group regarding a successful cyberattack against the organization. Such listings are a common tactic used by ransomware groups to pressure victims into paying ransoms by threatening the public release of sensitive information.

The claim follows a period of alleged unauthorized access to the organization's internal systems. Ransomware groups often employ a strategy known as double extortion, where they not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage for extortion. By publishing a target's name on a leak site, the attackers aim to damage the victim's reputation and create urgency through the threat of data exposure.

Details of the alleged incident

According to the claims made by the RansomHub group, the incident that led to this listing occurred on August 10, 2024. The group alleges that they gained access to the systems of Prasarana Malaysia Berhad during this timeframe. While the announcement was made in late August, the group asserts that the initial breach or system compromise took place approximately two weeks prior to the public listing.

The announcement specifically references the operational nature of the target, noting the organization's involvement in managing essential transit networks. This highlights a growing trend where threat actors target entities that manage large-scale public services, as these organizations often possess vast amounts of operational and corporate data.

Information regarding leaked data

At this stage of the incident, the RansomHub group has not provided specific details regarding the nature or the scope of the data they claim to have exfiltrated. There is no information available concerning the specific types of files, the total volume of data, or the total number of files involved in the alleged breach. Consequently, the listing names no specific data types.

The target organization

Prasarana Malaysia Berhad is a major transportation provider based in Malaysia. The organization plays a critical role in the country's infrastructure, specifically regarding its rail systems and bus networks. Because of its role in managing these essential transit services, the organization is a vital component of the regional transportation sector.

Potential risks and industry implications

The claim by RansomHub poses potential risks to the operational continuity and the security of sensitive corporate data for Prasarana Malaysia Berhad. In the transportation sector, which is classified as a provider of critical infrastructure services, data breaches can lead to significant consequences. These may include direct service disruptions or secondary risks involving the organization's third-party supply chain.

Furthermore, if the allegedly stolen data is published in the future, the organization and its stakeholders could face secondary risks such as identity theft or targeted phishing attacks. Such attacks often utilize stolen corporate or personal information to gain further access to networks or to defraud individuals.

RansomHub itself is a Ransomware-as-a-Service (RaaS) structure that emerged in early 2024. Reports indicate that the group has recruited former members of the ALPHV group, which suggests that the group may possess significant technical capabilities. This level of sophistication increases the potential impact of their campaigns on targeted organizations.

For organizations operating within critical infrastructure sectors, maintaining compliance with local data protection regulations, such as those in Malaysia, is a vital consideration following such claims. Defensive measures typically involve robust monitoring, regular security audits, and the implementation of strict access controls to mitigate the risk of unauthorized system access and subsequent data exfiltration.