Studio Negri e Associati listed on malas ransomware leak site

• Ransomware group: malas
• Country: Italy
• Sector: Professional Services
• Announcement date: April 9, 2023

The Italian professional services firm Studio Negri e Associati has been listed on the leak site of the ransomware group known as malas. The threat actor announced the targeting of the organization on April 9, 2023, claiming that the entity was affected by a cyberattack.

Details of the claimed attack

According to the announcement made by the threat actor known as malas, the organization was allegedly compromised via a Zimbra vulnerability. While the group has made this claim on their leak site, information regarding the specific identity and background of this group remains limited within the public domain. The announcement serves as a notification of a potential data breach, though the specifics of the intrusion remain under the control of the threat actor.

Information regarding the data

Regarding the specifics of the incident, no information has been provided by the threat actor concerning the nature of the leaked or threatened data. The listing does not specify the types of files or the volume of information involved. The evidence provided by the group consists of a screenshot that shows the organization's name listed within a directory, but it does not detail the content of that directory.

The listing names no data types.

About Studio Negri e Associati

Studio Negri e Associati is a law and consulting firm based in Milan, Italy. The company provides professional services in the fields of tax law, corporate consulting, and accounting.

Impact and potential risks

This claim may lead to disruptions in the organization's operational processes. If a data breach has occurred, the exposure of employee or client information could create risks for identity theft or targeted phishing attacks. Furthermore, depending on the region where the organization operates, administrative sanctions under data protection regulations such as GDPR may arise.

The threat actor's use of double extortion tactics to threaten the publication of data may be intended to exert pressure on the organization. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to release this data publicly, the attackers aim to increase the likelihood of receiving a ransom payment.

In such scenarios, organizations typically focus on several defensive and reactive measures. These include conducting thorough forensic investigations to determine the entry point, such as the mentioned vulnerability, and assessing the extent of the data exposure. Organizations in the professional services sector often prioritize securing communication channels and implementing strict access controls to protect sensitive client and financial information. Maintaining robust backup strategies and ensuring software is patched against known vulnerabilities are also standard defensive practices to mitigate the impact of such threats.