Stormous claims to sell network access for uffs.edu.br

• Ransomware group: Stormous
• Country: Brazil
• Sector: Education
• Announcement date: January 18, 2024

The threat actor known as Stormous has announced that it is offering network access belonging to the Brazilian institution uffs.edu.br for sale. According to a post made on a leak site on January 18, 2024, the group claims to have obtained unauthorized access to the organization's infrastructure.

Details of the claimed attack

The incident was announced by the Stormous group on January 18, 2024. The threat actor claims to have successfully compromised the network infrastructure of uffs.edu.br. Specifically, the group is offering VPN network access to the institution's systems for sale. The group asserts that this access includes entry into the institution's servers and databases.

In terms of the financial demands associated with this claim, the group has requested a price of 0,029 BTC. This amount is presented as either a ransom or a sale price for the access being offered on the leak site. While the group has specified the type of access being sold, they have not provided any specific details regarding the contents of any data files that might be involved in the breach.

Information regarding the data involved

The announcement specifies that the primary asset being offered is VPN network access. However, the listing does not provide specific details regarding the contents of any data files.

• No specific data file contents were provided in the announcement.

About the organization

UFFS (Universidade Federal da Fronteira Sul) is a public federal university operating in the southern region of Brazil. It was established to provide higher education and promote regional development across the states of Santa Catarina, Paraná, and Rio Grande do Sul.

Analysis and potential implications

This incident may indicate that the institution's network security has been compromised. The Stormous group is known to be a politically motivated entity that has been active since 2021, often combining data leaks with ransom demands. The nature of this claim, involving the sale of VPN access, suggests a high level of risk for the institution.

The sale of such access may lead to secondary attacks, identity theft, or broader data breaches within the institution's network. Furthermore, considering the group's known methods, it is assessed that the incident could have negative implications for the institution's reputation. Because the institution is based in Brazil, a potential data breach could trigger legal obligations under the Brazilian General Data Protection Law (LGPD).

In general, when organizations face such threats, they often deal with the complexities of double extortion, where attackers not only encrypt data but also threaten to leak it to increase pressure. For educational institutions, protecting sensitive research, student records, and administrative data is critical. Defensive measures typically involve implementing multi-factor authentication, maintaining strict network segmentation, and ensuring robust monitoring of VPN logs to detect unauthorized access attempts. Organizations in this sector must remain vigilant against the sale of credentials or access points on dark web marketplaces to prevent cascading security failures.