Stormous group claims VPN access and data leak involving comtrade.com

• Ransomware group: Stormous
• Country: Slovenia
• Sector: Technology
• Announcement date: December 21, 2023

The Stormous ransomware group has announced a potential data leak and the sale of unauthorized VPN access allegedly belonging to the technology company comtrade.com. The announcement, which appeared on the group's leak site, suggests a significant compromise of the organization's network infrastructure.

The details of the claim

According to the announcement posted on December 21, 2023, the Stormous group claims to have successfully obtained access to a VPN network belonging to comtrade.com. This access is reportedly capable of bypassing established security barriers within the organization's network. Rather than just claiming a breach, the group is actively attempting to monetize this access by offering it for sale for a ransom demand of 0.10 BTC.

The listing includes a countdown timer, a common tactic used by ransomware groups to pressure victims. This timer indicates that the stolen data may be released publicly upon its expiration. Such tactics are characteristic of double extortion schemes, where attackers not only encrypt data but also threaten to leak sensitive information to increase the likelihood of payment.

Data involved in the incident

Regarding the specific content of the alleged breach, the announcement provides limited information. The listing names no specific data types or details regarding the scope of the files involved.

Organization profile

Comtrade is a well-established technology group based in Southeast Europe. The company specializes in software engineering, system integration, and digital transformation solutions. With over 30 years of experience, the organization provides proprietary software solutions and professional services across various industries.

Analysis and potential implications

The claims made by the Stormous group suggest that the organization's network infrastructure may have been compromised. The sale of VPN access is particularly concerning, as it could lead to an increase in secondary attacks or significant supply chain risks against the organization. Because the group's claims suggest they may be politically motivated, the attack might be focused on damaging the organization's reputation as much as achieving financial gain.

Given that the organization operates within the technology sector, a successful leak could have potential impacts on customer data and intellectual property. If a data leak is confirmed, the organization may face legal obligations under various regulations, such as the GDPR.

In general, when organizations face such threats, defensive measures often include strengthening identity and access management, implementing multi-factor authentication for all remote access points, and continuous monitoring of network traffic for unusual patterns. Ransomware leak sites serve as a platform for these groups to conduct their extortion, often using the threat of public exposure to drive compliance with their demands.