SiegedSec ransomware group lists Operation Israel - 1 on its leak site

• Ransomware group: SiegedSec
• Country: Israel
• Sector: Government & Defense
• Announcement date: December 8, 2023

SiegedSec claims a multi-sector data breach in Israel

The ransomware group known as SiegedSec has announced the release of data that they claim belongs to several Israeli entities. According to an announcement made on a leak site on December 8, 2023, the group alleges they have compromised data belonging to Israeli government entities, the Shufersal supermarket chain, and the airline Israir. This breach, referred to by the group as "Operation Israel - 1," involves a variety of sectors, including government and defense, as well as private commercial interests.

The group has indicated that the allegedly stolen information has been made available to the public via a file-sharing platform. While the group has made these claims, the specific details regarding the volume of data or the specific ransom demands have not been provided in the announcement.

Details of the claimed attack

According to the claims made by SiegedSec, the cyberattack was conducted on November 26, 2023. The group asserts that they successfully accessed various sensitive systems during this operation. The scope of the alleged intrusion is broad, spanning across different types of infrastructure and organizational tiers.

The group claims to have targeted government devices, the infrastructure of a major supermarket chain, and various documents belonging to a commercial airline. Such attacks often follow the pattern of double extortion, a common tactic used by ransomware groups where data is not only encrypted but also exfiltrated to be used as leverage for ransom demands. In these scenarios, threat actors threaten to leak sensitive information on public leak sites if the victim fails to meet their demands.

The scope of the alleged data theft

The announcement details several types of information that the group claims to have exfiltrated from the targeted organizations. The data allegedly stolen includes a mix of administrative, technical, and operational information. The specific items mentioned in the claim include:

• System data
• Infrastructure device information
• Internal reports
• Software details
• Access credentials

Specifically, the group claims to possess system data allegedly belonging to the Israeli Ministry of Agriculture. Furthermore, the leak is said to include infrastructure device information from the Shufersal supermarket chain. For the airline Israir, the group claims to have obtained internal reports, software details, and access credentials.

Potential impact and security implications

The exposure of this data could lead to significant operational disruptions and privacy breaches for the affected entities. For the supermarket and airline sectors, the disclosure of such information increases the risk of identity theft or phishing attacks targeting customers and employees. When access credentials and software details are leaked, it provides a roadmap for further unauthorized access to secure networks.

Furthermore, the disclosure of government data, such as that allegedly taken from the Ministry of Agriculture, may pose secondary risks to national security processes. Such breaches can undermine the integrity of administrative functions and expose sensitive governmental workflows.

In response to such incidents, cybersecurity experts generally recommend that affected organizations take immediate defensive steps. These include invalidating any leaked credentials to prevent further unauthorized access and conducting a thorough review of system security to identify and patch vulnerabilities. Maintaining robust monitoring and implementing multi-factor authentication are standard practices to mitigate the risks associated with credential theft and unauthorized lateral movement within a network.