Underground ransomware group lists awwg.com on leak site

• Ransomware group: Underground
• Country: Spain
• Sector: Professional Services
• Announcement date: May 1, 2024

Underground claims data breach against awwg.com

The threat actor known as Underground has officially listed the Spanish organization awwg.com on its leak site. According to the group's announcement, the breach involves a significant volume of sensitive information, with the group claiming to possess 204.9 GB of data belonging to the company.

This type of activity is characteristic of modern ransomware operations, particularly those employing double extortion tactics. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to publish confidential files on a public leak site, the attackers aim to pressure the victim into paying a ransom, often using the threat of reputational damage or regulatory fines as motivation.

Details of the alleged incident

The Underground group announced the listing of awwg.com on May 1, 2024. While the announcement was made in May, the group alleges that the actual security incident occurred much earlier, specifically on January 25, 2024. This suggests that the attackers may have maintained presence within the network for several months before making their claims public.

The group claims that the stolen information is not limited to a single category but includes a wide array of sensitive documentation. Based on the information provided by the attackers, the alleged leak includes the following types of data:

• Employee personal data
• Financial documents
• Legal documents
• Passport and ID information
• Payroll data

The presence of such diverse data types—ranging from individual identification to corporate legal agreements—indicates a broad compromise of the organization's digital environment.

About awwg.com

AWWG, which was formerly known as Pepe Jeans Group, is a prominent international fashion and retail company. Headquartered in Spain, the organization manages a portfolio of well-known global brands, including Pepe Jeans London, Hackett London, and Façonnable.

Potential impact and security implications

The nature of the data allegedly stolen poses several critical risks to the organization and its stakeholders. For the employees and executives whose personal information was targeted, there is a heightened risk of identity theft. The exposure of sensitive identifiers such as passports, IDs, and social security numbers provides malicious actors with the necessary tools to commit fraud or conduct targeted social engineering attacks.

From a corporate perspective, the disclosure of strategic information could be devastating. The alleged theft of design collections, shareholder agreements, and non-disclosure agreements (NDAs) could potentially harm the organization's competitive advantage by revealing trade secrets and strategic business plans. Furthermore, because the company operates within regions governed by strict data protection frameworks, such a breach could trigger formal legal processes regarding data protection violations under the General Data Protection Regulation (GDPR).

The Underground group itself remains a relatively obscure entity, as information regarding their specific tactics, techniques, and procedures is limited. However, the fallout from such a leak often extends beyond the initial disclosure. Organizations frequently observe secondary phishing attacks targeting the stakeholders of the breached company, as attackers use the stolen contact information to conduct more sophisticated social engineering campaigns. These follow-up attacks can disrupt operational processes and further compromise the security posture of the organization's partners and clients.

To defend against such threats, organizations in the professional services and retail sectors typically focus on robust data loss prevention (DLP) strategies, strict access controls, and comprehensive employee training to recognize phishing attempts. Monitoring for unauthorized data exfiltration and maintaining a rapid incident response plan are also essential components of a modern cybersecurity defense strategy.