RansomHub ransomware group lists www.psgbdvor.rs on its leak site

• Ransomware group: RansomHub
• Country: Serbia
• Sector: Professional Services
• Announcement date: June 4, 2024

RansomHub claims data breach against psgbdvor.rs

The RansomHub ransomware group has announced a data leak claim against the organization psgbdvor.rs on their dedicated leak site. According to the announcement published on June 4, 2024, the threat actors claim to have successfully breached the systems of the Serbian-based professional services entity. This incident follows a claimed attack date of May 20, 2024.

Details of the alleged attack

In their announcement, the RansomHub group alleges that they gained unauthorized access to the internal systems of psgbdvor.rs. A significant aspect of the group's claim involves the disruption of industrial control systems; specifically, the attackers allege that the organization's SCADA systems were disabled during the operation. This type of interference is a hallmark of high-impact ransomware attacks that target operational technology alongside traditional IT environments.

The group further claims to have exfiltrated a substantial amount of information, totaling 80 GB of data. In addition to the technical details of the breach, the threat actors shared a statement that specifically targets a particular employee, holding that individual responsible for the incident. While the group has made these claims, no information was provided regarding a specific ransom demand.

Scope of the alleged data exfiltration

The RansomHub group has provided a detailed list of the types of information they claim to have stolen from the organization. The alleged data encompasses a wide variety of sensitive business and operational documents. The categories of data mentioned in the claim include:

• IT data
• Accounting data
• Financial records
• Project files
• Customer database in SQL format
• Budget records
• Tax records
• Logistics data
• Supply chain data
• Production data
• HR records
• Legal data
• R&D data

The inclusion of such diverse datasets, ranging from financial and tax records to production and R&D documents, suggests a comprehensive breach of the organization's digital infrastructure.

Potential impact and organizational risks

These claims suggest that the organization's critical infrastructure and operational data may be at risk of exposure. Specifically, the claim regarding interference with SCADA systems could lead to disruptions in industrial processes and damage operational continuity. Such attacks are particularly concerning as they bridge the gap between digital intrusion and physical operational impact.

The exfiltrated data, which includes personal and financial information, may trigger legal sanctions under relevant regulations and cause reputational damage to the institution. Furthermore, given the past activities of the RansomHub group, the publication of the data could lead to secondary attacks or targeted phishing attempts against the organization or its stakeholders. It is noted that public information about this specific group remains limited.

In general, ransomware attacks of this nature often follow a double extortion model. In this scenario, threat actors do not just encrypt systems to disrupt operations, but they also steal sensitive data to use as leverage. If a ransom is not paid, the attackers threaten to leak the stolen information on public forums or leak sites to pressure the victim. To defend against such threats, organizations typically implement multi-factor authentication, maintain offline backups, and monitor network traffic for unusual exfiltration patterns. However, when SCADA systems are involved, the complexity of the defense increases, requiring specialized security measures for industrial control networks to ensure operational continuity and prevent unauthorized access to critical processes.