Stormous ransomware group lists alleged network access for inwi.ma

• Ransomware group: Stormous
• Country: Morocco
• Sector: Technology
• Announcement date: December 21, 2023

Stormous group claims to have obtained access to inwi.ma

The Stormous ransomware group has announced that it is offering for sale alleged network access belonging to the telecommunications operator inwi.ma. According to the group's announcement on its leak site, the access was obtained on December 21, 2023. The group is currently demanding a ransom of 0.068 BTC to prevent further action or to facilitate the transaction.

Ransomware groups often use leak sites to pressure organizations into paying ransoms. This process frequently involves double extortion, where the threat actor not only encrypts an organization's data but also threatens to leak sensitive information publicly if the demands are not met. By listing access for sale, the group creates a market for stolen credentials or entry points, which can lead to further exploitation by various malicious actors.

Details of the alleged breach and group claims

The Stormous group has listed an alleged VPN access belonging to the organization inwi.ma on its leak site. The group claims that this specific access allows for bypassing the organization's firewalls and intrusion detection systems. This type of access is highly critical, as it provides a pathway into a protected network environment that would otherwise be shielded from external threats.

Furthermore, the group has issued threats against the organization. They have stated that they will launch attacks against the organization if the access is not sold or if certain criteria are not met. This highlights the aggressive nature of the group's tactics, where they use the threat of continued attacks to drive compliance with their demands.

Information regarding the scope of the leak

The advertisement offers a VPN connection that allegedly provides access to the organization's network infrastructure, servers, and databases. However, regarding the specific content of the breach, the listing names no data types or specific lists of leaked data files.

About inwi.ma

Inwi is a leading telecommunications operator based in Morocco. It provides voice, internet, and data services to both individual and corporate clients.

Security implications and industry risks

This incident may indicate that the organization's network security has been compromised. The sale of access could lead to third parties infiltrating critical infrastructure and result in data breaches. Given that the organization operates in the telecommunications sector, risks to the confidentiality of customer data may be observed. The politically motivated actions of the Stormous group, which has been active since 2021, may create secondary pressure on the organization.

For organizations operating within the telecommunications sector, such incidents underscore the necessity of robust security postures. When a VPN or network access point is compromised, the entire infrastructure—including servers and databases—becomes vulnerable. To mitigate these risks, organizations often implement defensive measures such as multi-factor authentication, continuous monitoring of network traffic, and regular audits of access points. Reviewing network access points and enhancing security measures is a critical step for any organization facing such threats.

General defensive considerations

In the broader context of cybersecurity, the sale of network access represents a significant risk to critical infrastructure. When attackers gain entry through legitimate channels like VPNs, they can move laterally through a network to reach sensitive databases. Organizations can defend against these methods by adopting a zero-trust architecture, which requires continuous verification of every user and device attempting to access resources on the network, regardless of whether they are inside or outside the network perimeter.