Werewolves group claims data breach at vasexperts.ru

• Ransomware group: werewolves
• Country: Russia
• Sector: Technology
• Announcement date: December 23, 2023

Werewolves claims compromise of vasexperts.ru data

The threat actor known as werewolves has announced the alleged compromise of data belonging to the technology company vasexperts.ru. According to the announcement posted on a leak site on December 23, 2023, the group claims to have targeted the organization on December 17, 2023. The group is reportedly demanding a ransom of 640,000 USD to prevent the public release of the stolen information. Publicly available information regarding the specific identity and operations of the werewolves group remains limited.

Ransomware attacks often follow a pattern of double extortion, where attackers not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive data to use as leverage. By threatening to publish stolen information on a leak site, attackers aim to pressure the victim into paying a ransom to protect their reputation and avoid regulatory or legal consequences. This tactic places immense pressure on organizations to comply with financial demands to prevent the exposure of intellectual property or client data.

Details of the alleged data theft

The werewolves group claims to have obtained a massive volume of data, estimated at 250 TB. The group asserts that the stolen information includes the company's proprietary software developments and critical technical assets. Specifically, the attackers claim to have accessed the source codes for the company's traffic control and analysis software. Furthermore, the group alleges that they have secured distribution files belonging to the company's business partners.

The content of the breach is said to include:

• Source codes
• Software distribution files

The announcement was accompanied by a screenshot showing a security verification screen encountered while accessing the leak site. The scale of the claimed data theft suggests a significant breach of the organization's digital infrastructure.

About VAS Experts

VAS Experts is a technology company that develops software solutions for network traffic control and analysis. Operating since 2013, the company has a wide installation network across CIS countries and international markets. The company provides specialized tools designed for monitoring and managing network traffic, serving a diverse client base through its established distribution and installation networks.

Potential impact and defensive considerations

The alleged compromise of 250 TB of data may pose significant risks to the company's intellectual property and commercial operations. The exposure of source codes could potentially lead to the exploitation of vulnerabilities within the company's products, as attackers may use the code to find flaws to exploit in future attacks. Furthermore, the leakage of data belonging to business partners may negatively impact supply chain security and damage the company's market reputation. Should the ransom demand remain unpaid, the potential public release of this data could lead to long-term operational and reputational consequences for the organization.

For organizations operating in the technology and software development sector, protecting intellectual property is a critical priority. Such breaches highlight the importance of robust security frameworks designed to protect the software development lifecycle. Organizations often implement various defensive measures to mitigate these risks, such as:

• Strict access controls: Implementing the principle of least privilege to ensure that only authorized personnel can access sensitive source code repositories.
• Data loss prevention (DLP): Utilizing tools to monitor and block the unauthorized transfer of sensitive data outside the corporate network.
• Network segmentation: Dividing networks into smaller segments to prevent attackers from moving laterally from less secure areas to critical development environments.
• Regular security audits: Conducting frequent assessments of software code and network infrastructure to identify and remediate vulnerabilities before they can be exploited.

The potential for long-term operational disruption and the risk to the supply chain underscore the necessity for comprehensive incident response plans. When a breach occurs, organizations must be prepared to manage the fallout, which may include legal, regulatory, and reputational management.