Stormous ransomware group lists evn.com.vn on its leak site

• Ransomware group: Stormous
• Country: Vietnam
• Sector: Energy & Utilities
• Announcement date: December 21, 2023

Stormous claims to have compromised Vietnam Electricity network

The threat actor known as Stormous has published an announcement on a leak site claiming to have gained unauthorized access to the network of the Vietnam-based energy company evn.com.vn. In the listing, the group claims to be selling access credentials that could allow for entry into the institution's infrastructure. This claim was made on December 21, 2023.

The group's announcement suggests that the access they have obtained is significant enough to bypass existing security measures. According to the threat actor, the credentials provide a way to circumvent firewalls and intrusion detection systems, potentially allowing an attacker to reach sensitive internal areas of the network, including servers and databases.

Details of the claimed intrusion

The event, as described by the Stormous group, involves the exploitation of the organization's VPN network. The group asserts that the access they have secured allows for unauthorized entry into the institution's internal network infrastructure. This type of access is highly sought after by various malicious actors because it provides a foothold within a protected environment.

The threat actor has explicitly stated that they are offering the sale of these VPN access credentials and the associated capabilities for unauthorized entry into the network infrastructure. Furthermore, the group has issued a threat, stating that they will launch further attacks against the institution if the access is not purchased for the demanded amount of 0.068 BTC.

Affected data and information

Regarding the specific types of information or files that may have been compromised, the listing names no data types.

About Vietnam Electricity (EVN)

Vietnam Electricity (EVN) is the largest power generation, transmission, and distribution company in Vietnam. As a state-owned utility provider, it serves millions of customers across the country and plays a vital role in the nation's infrastructure.

Risk assessment and implications for critical infrastructure

This situation poses significant risks to the institution's operational continuity and the security of its infrastructure. Because the organization serves as a provider of critical infrastructure services, the transfer of network access to third parties could lead to disruptions in energy distribution processes. Such a scenario creates a cascading risk that could ultimately result in the disclosure of sensitive operational information and customer data.

The nature of the threat actor adds another layer of complexity to this incident. The Stormous group has been active since 2021 and has claimed to be politically motivated, which suggests that the attack could carry secondary objectives beyond simple financial extortion. When threat actors are driven by political motives, the goals of an attack may extend to disruption or propaganda.

In the broader context of cybersecurity, such incidents highlight the importance of robust perimeter defenses and the monitoring of remote access points. Organizations in the energy and utilities sector often face high-stakes threats due to the essential nature of their services. To mitigate these risks, it is common for organizations to implement multi-factor authentication (MFA), strict network segmentation, and continuous monitoring of VPN logs to detect anomalous behavior. Protecting critical infrastructure requires a layered defense strategy to prevent unauthorized actors from moving laterally through the network once a perimeter has been breached.