Stormous ransomware group lists rmutto.ac.th on its leak site

• Ransomware group: Stormous
• Country: Thailand
• Sector: Education
• Announcement date: December 21, 2023

The ransomware group known as Stormous has published a ransom announcement targeting rmutto.ac.th, which is the domain for Rajamangala University of Technology Tawan-Ok. In the listing, the group claims to be selling access to the institution's network infrastructure.

The claimed attack and ransom demand

According to the announcement posted on the group's leak site on December 21, 2023, the threat actor known as Stormous claims to have successfully gained access to the institution's network infrastructure, servers, and databases. The group asserts that they have bypassed existing security measures, specifically mentioning that they have gained access to the institution's VPN network and entire infrastructure by bypassing firewalls and intrusion detection systems.

The group has issued a ransom demand of 0.068 BTC for this access. Furthermore, the threat actor has issued a threat, stating that an attack may be launched if the access is not sold. This method of operation, where a group claims to have infiltrated a network and offers the access to a third party or demands payment to prevent further action, is a common tactic used by modern threat actors.

Data involved in the claim

While the group claims to have access to the network infrastructure, servers, and databases, the announcement does not provide a detailed list of specific data types leaked.

• No specific data types were listed in the announcement.

In many ransomware incidents, threat actors employ a strategy known as double extortion. This involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information to threaten its public release. This tactic increases the pressure on the victim to pay the ransom, as the threat of a data leak can cause significant reputational and legal damage.

Assessment of the situation

This situation may carry the risk of exposing student and staff data within the university. Unauthorized access to the network infrastructure could potentially lead to the manipulation of academic data or the creation of an entry point for secondary attacks. Given the politically motivated actions of the Stormous group, it is assessed that such breaches may increase risks such as targeted phishing or identity theft.

The group's past activities indicate that they employ methods combining data leaks with ransom demands. Furthermore, it is likely that the institution may face legal obligations under Thai data protection regulations due to the nature of the claimed breach.

Defensive considerations for educational institutions

For organizations in the education sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Protecting a vast network that includes various users, such as students and staff, requires a multi-layered defense strategy. This typically includes maintaining up-to-date security patches, implementing strict access controls, and ensuring that intrusion detection systems are actively monitored.

To mitigate the risks of unauthorized access to VPNs and core infrastructure, organizations often implement multi-factor authentication (MFA) and continuous monitoring of network traffic to detect anomalies. Additionally, maintaining regular, offline backups is a fundamental step in defending against ransomware, as it allows for data recovery without complying with ransom demands. As seen in this case, the threat of secondary attacks or data manipulation necessitates a comprehensive approach to both perimeter security and internal data integrity.