TBIT Services listed on malas ransomware leak site

• Ransomware group: malas
• Sector: Professional Services
• Announcement date: April 9, 2023

The professional services organization TBIT Services has been listed on the leak site associated with the ransomware group known as malas. The announcement, which appeared on the group's platform, indicates a potential security breach involving the organization.

The claims made by the malas group

According to the announcement published by the malas group, TBIT Services has been targeted in a recent cyberattack. The group has released a list on their leak site that includes the name of the organization. A significant detail provided in the group's claim is the alleged method of entry; it is claimed that a vulnerability within the Zimbra software was utilized to facilitate the attack against the organization.

Following the initial intrusion, the group has issued threats to publish the organization's data. This tactic is a hallmark of modern ransomware operations, often referred to as double extortion. In such scenarios, threat actors do not merely encrypt files to disrupt operations but also steal sensitive information to use as leverage. By threatening to release stolen data on a public leak site, the attackers aim to pressure the victim into meeting their demands through the threat of reputational damage and regulatory scrutiny.

Details regarding the involved data

At this stage, there is no detailed information regarding the specific nature of the data that has been leaked or is being threatened for publication. While the group's leak site displays a screenshot showing the organization's name listed, they have not provided any data samples to verify the scope of the breach. Furthermore, there is no information available regarding the total size of the data or the specific count of files involved in the incident.

• No specific data types have been identified in the listing.

Organization profile

TBIT Services operates within the professional services sector. The specific details regarding the organization's internal structure or specific operational profile were not provided in the available documentation.

Assessment and organizational implications

This incident suggests that a security breach may have occurred within the systems of TBIT Services. The reported use of a Zimbra vulnerability may indicate potential weaknesses in the organization's network security, specifically regarding the management and patching of internet-facing software. Vulnerabilities in widely used communication or collaboration tools often serve as primary entry points for sophisticated threat actors.

If the threatened data is eventually published, secondary risks could arise for the organization's clients and employees. These risks include, but are not limited to, identity theft and targeted phishing attacks. Such downstream effects can cause significant disruption to the business relationships and personal security of the affected parties.

Regarding the threat actor, information about the malas group remains limited. Because of this lack of public information, it is not possible to make a definitive assessment regarding the group's specific motivations or their technical methods. For organizations in the professional services sector, maintaining robust patch management protocols and monitoring for unauthorized access to communication software is a critical defensive step to mitigate such risks.