Stormous claims network access to zewailcity.edu.eg

• Ransomware group: Stormous
• Country: Egypt
• Sector: Education
• Announcement date: December 21, 2023

Stormous claims access to zewailcity.edu.eg infrastructure

The threat actor known as Stormous has listed network access and data allegedly belonging to zewailcity.edu.eg on its leak site. This announcement, made on December 21, 2023, indicates that the group claims to have successfully infiltrated the digital environment of the institution.

According to the claims made by the group, they have gained access to the network infrastructure of zewailcity.edu.eg. Rather than just claiming to have stolen files, the group is offering direct access to the institution's network infrastructure and servers. To facilitate this access, the group is demanding a ransom of 0.057 BTC.

Details of the alleged breach

The information provided by the threat actor suggests a significant level of intrusion into the organization's digital assets. Based on the screenshots provided by the group, they claim to have obtained access to several critical components of the institution's digital environment.

The listing claims that access has been secured for the following:

• Network infrastructure
• Servers
• Databases

While the group claims to have access to these core components, there is no detailed list of specific file types leaked or accessed. No specific information regarding the total volume of data or the exact file count was provided in the announcement.

Implications and potential risks

This incident suggests that the digital infrastructure of educational institutions may pose a risk from cyber threat actors. The sale of network access is a particularly dangerous development, as it could lead to third parties infiltrating the system and potentially causing wider data breaches beyond the initial actor.

Given the Stormous group's politically motivated actions, the institution may experience reputational damage and operational disruptions. Furthermore, there is a secondary risk that the stolen data could potentially be used in identity theft or targeted phishing attacks against the institution's members.

From a legal perspective, it is possible that the institution may face legal processes under data protection regulations in Egypt. This highlights the growing necessity for organizations to implement robust defensive measures. Common defensive steps for organizations include maintaining regular offline backups, implementing multi-factor authentication across all entry points, and conducting frequent security audits to identify vulnerabilities in network infrastructure before they can be exploited by threat actors.

The nature of ransomware leak sites

Ransomware leak sites serve as a platform for threat actors to exert pressure on victims through a method often referred to as double extortion. In such scenarios, attackers do not merely encrypt data to disrupt operations; they also steal sensitive information to threaten its public release. This dual approach increases the pressure on an organization to pay the ransom to prevent both operational downtime and the reputational damage associated with a public data leak.