tks.co.th listed on Lockbit3 leak site

• Ransomware group: Lockbit3
• Country: Thailand
• Sector: Professional Services
• Announcement date: November 4, 2023

LockBit3 claims to have stolen data from tks.co.th

The LockBit3 ransomware group has officially listed the organization tks.co.th on its dedicated leak site. In this announcement, the threat actor group claims to be in possession of data belonging to the organization. This development follows a common pattern in modern cyberattacks where groups use public-facing leak sites to pressure victims by threatening to release sensitive information if certain conditions are not met.

The listing, which appeared on November 4, 2023, serves as a public claim by the ransomware group. According to the announcement made by the group on the same date, they intend to publish data that they allege was obtained through their unauthorized access to the organization's systems. To support their claim, the group has provided samples of various documents that appear to be related to the internal operations of the target organization.

Details of the alleged data leak

The information provided by the group suggests that the leaked content includes various types of corporate documentation. Based on the screenshots provided by the attackers, the data appears to consist of several categories of sensitive business information. The specific types of data identified in the samples include:

• Commercial invoices
• Job proposals
• Corporate correspondence

The presence of such documents in a leak site listing indicates that the attackers have gained access to administrative or operational files. While the specific volume of data and the total file count have not been disclosed by the group, the samples provided allow for an assessment of the types of information that may be at risk of exposure.

About T.K.S. Technologies PCL

T.K.S. Technologies PCL is a prominent company based in Thailand. Founded in 1954, the organization has a long history in the printing and technology sectors. The company specializes in the production of various essential business items, including security forms, business forms, and stationery products. Additionally, the organization provides a range of digital printing solutions to its clients.

Risk assessment and industry implications

The claim made by LockBit3 poses significant risks to the organization. The potential exposure of trade secrets and operational data could undermine the company's competitive advantage. Furthermore, the shared document samples may contain sensitive details regarding the organization's professional relationships with third parties. Such a breach of confidentiality can lead to a substantial loss of reputation among the organization's existing customers and business partners.

Beyond immediate reputational damage, there is a high risk of secondary exploitation. The leaked data could be utilized by malicious actors to launch targeted phishing campaigns or other secondary attacks against the organization or its partners. In such scenarios, attackers use the stolen information to craft highly convincing messages that appear to come from trusted sources, increasing the likelihood of further compromise.

LockBit is a known Ransomware-as-a-Service (RaaS) group that has been tracked by security researchers since 2019. It is worth noting that despite an international law enforcement operation targeting its infrastructure in February 2024, reports indicate that the group has resumed its malicious activities. This resilience highlights the ongoing threat posed by sophisticated RaaS models to organizations globally.

For organizations operating in the professional services and manufacturing sectors, maintaining robust cybersecurity defenses is critical. This includes implementing strict access controls, conducting regular security audits, and ensuring that all digital printing and production workflows are protected by multi-factor authentication and encryption. Protecting the integrity of corporate correspondence and commercial documents is essential to maintaining trust in a digital business environment.