Trylon Srl listed on incransom leak site

• Ransomware group: incransom
• Country: Romania
• Sector: Professional Services
• Announcement date: May 1, 2024

The ransomware group known as incransom has listed the Romanian telecommunications company Trylon Srl on its leak site. The announcement, which was posted on May 1, 2024, indicates that the group claims to have targeted the organization in a recent cyberattack.

The claimed attack event

According to the information published by the threat actor, the incident involving Trylon Srl was claimed to have occurred on April 30, 2024. The incransom group alleges that they have successfully obtained data related to the institution's telecommunications infrastructure services. This claim suggests that the attackers focused their efforts on the core service offerings provided by the organization.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their victims. In these scenarios, threat actors often publish stolen information to coerce organizations into paying a ransom. This practice is a hallmark of modern cyber extortion, where the threat of public exposure is used as a primary leverage tool against the victimized entity.

Details regarding the alleged leaked data

Despite the claim of a successful data theft, the specific details regarding the nature of the alleged leaked data remain unclear. The available records and screenshots provided by the group do not offer specific details concerning the exact contents or the categories of information that were purportedly exfiltrated during the incident.

The listing names no specific data types or affected data categories.

Potential risks of double extortion

When analyzing such incidents, it is important to consider the concept of double extortion. This tactic involves two distinct stages: first, encrypting the victim's systems to disrupt operations, and second, stealing sensitive data to threaten its public release. By threatening to leak information, attackers increase their chances of receiving payment, as the damage from a data breach often outweighs the damage caused by a simple system lockout.

About Trylon Srl

Trylon Srl is a telecommunications company based in Romania. The firm provides a wide range of services, including steel tower infrastructure, site acquisition, engineering, installation, and technical services for wireless networks. Having operated for nearly 100 years, the company provides structural solutions that are essential for the expansion of technologies such as LTE and broadband internet.

Impact assessment and organizational implications

Given the double-extortion tactics employed by the incransom group, there is a possibility that the institution's operational data and commercial information may have been compromised. Such a breach could create negative impacts on the institution's operations in North America and its customer relations. Furthermore, as a Romania-based institution, it is likely that legal processes under the European Union's General Data Protection Regulation (GDPR) may be triggered due to the nature of the alleged breach.

The leaked data could lead to secondary risks, such as targeted phishing attacks or corporate identity theft. When sensitive corporate information is leaked, attackers often use it to craft highly convincing social engineering campaigns, targeting employees or clients to gain further access to secure networks or financial assets.

Defensive measures for the sector

Organizations operating within the telecommunications and professional services sectors can take several steps to mitigate these risks. Implementing robust data encryption for data at rest and in transit can help protect sensitive information even if a breach occurs. Additionally, maintaining strict access controls and multi-factor authentication (MFA) can prevent unauthorized access to critical infrastructure and administrative accounts.

Regularly updating security protocols and conducting comprehensive vulnerability assessments are also vital components of a strong defense. Because public information about the incransom group is limited, organizations must remain vigilant against their evolving tactics and maintain a high state of readiness for potential data exfiltration attempts.