Tri Thuc Software listed on desolator ransomware leak site

• Ransomware group: desolator
• Country: Vietnam
• Sector: Technology
• Announcement date: August 30, 2025

The desolator ransomware group has listed Tri Thuc Software on its leak site, claiming to have exfiltrated a significant amount of data from the organization. According to the announcement made on August 30, 2025, the threat actor group claims the breach occurred on August 27, 2025. The group asserts that the stolen information totals approximately 1.4 TB in size.

Details of the claimed attack

The announcement posted by the desolator group outlines a significant security incident targeting the Vietnamese technology firm. The group claims that the breach took place several days before the public listing on their leak site. While the specific method of entry or the exact nature of the vulnerability used remains unstated in the announcement, the scale of the data involved suggests a targeted operation aimed at high-value digital assets.

In many modern ransomware campaigns, threat actors employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive information before the encryption process begins. The threat of releasing this stolen data on a public leak site serves as additional leverage to pressure the victim into paying a ransom. This method is designed to maximize the impact of the attack by threatening the victim's reputation and legal standing.

Compromised data types

The desolator group has specified the types of information they claim to have successfully exfiltrated from Tri Thuc Software's infrastructure. The leaked data is reported to include several critical categories of information that are vital to the company's operations and intellectual property. The specific items mentioned in the claim are:

• Application source codes
• Company documents
• Backup files

The inclusion of source code and backup files is particularly significant for a technology-focused organization. Source code represents the fundamental intellectual property of a software company, and its exposure can lead to long-term security vulnerabilities and competitive disadvantages. Backup files, if compromised, can provide attackers with a comprehensive overview of an organization's historical data and system configurations.

About Tri Thuc Software

Tri Thuc Software is a software company based in Vietnam. The organization operates within the technology sector, specifically focusing on providing enterprise software solutions and licensed software products. As a provider of enterprise-level tools, the company's digital assets and the integrity of its software products are central to its business model and its relationships with clients.

Potential impact and industry implications

This incident may have negative impacts on the intellectual property rights and operational continuity of Tri Thuc Software. The leakage of source codes could weaken the security of the software developed by the institution and provide an advantage to competitors. Furthermore, the breach may damage the institution's credibility among its customers and business partners and could trigger legal processes under relevant data protection regulations in Vietnam.

For organizations operating in the technology and software development sector, incidents of this nature highlight the critical need for robust security frameworks. Protecting intellectual property, such as application source code, is a primary concern for software providers. When source code is exposed, it can be analyzed by malicious actors to find new vulnerabilities, potentially leading to downstream attacks against the company's customers who use the affected software.

To mitigate such risks, organizations typically implement defensive strategies such as multi-factor authentication, rigorous access controls, and continuous monitoring of network traffic. Additionally, securing backup files is essential, as they are often targeted to prevent organizations from recovering from an attack without paying a ransom. Maintaining strong encryption for data at rest and in transit, along with strict identity and access management (IAM) protocols, remains a fundamental component of a modern cybersecurity posture.