Werewolves ransomware group claims data breach at croc.ru

• Ransomware group: Werewolves
• Country: Russia
• Sector: Technology
• Announcement date: December 20, 2023

The Werewolves ransomware group has announced on its leak site that it has successfully compromised data belonging to the Russia-based technology company croc.ru. According to the announcement made on December 20, 2023, the threat actor claims to have exfiltrated sensitive information and is currently engaged in negotiations with the target organization.

Details of the claimed attack

The threat actor known as Werewolves has asserted that the breach occurred on September 27, 2023. In their public announcement, the group claims that the stolen data is being securely stored on their own servers. The group has stated that ransom negotiations with croc.ru are currently ongoing. As part of this extortion attempt, the group has issued a ransom demand of 170,000 dollars.

This type of activity is characteristic of modern ransomware operations, often referred to as double extortion. In these scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to leak confidential information on public leak sites, the attackers aim to pressure the organization into paying the ransom to prevent reputational damage and the exposure of proprietary information.

Scope of the compromised data

While the announcement explicitly names the organization, the group has not provided a detailed breakdown or a specific inventory of the exact types of data that were leaked. However, the group claims that the exfiltrated information is related to the organization's core business operations, specifically involving the following areas:

• System integration
• Cloud services
• Data center operations

The listing does not provide information regarding the total volume of data stolen or the specific number of files involved in the breach.

About croc.ru

CROC is a leading Russian technology company that has been operating since 1992. The organization provides a wide range of services within the technology sector, including system integration, cloud computing, and data center management. Additionally, the company specializes in advanced technologies such as artificial intelligence and provides B2B managed services and digital transformation solutions to its clients.

Impact assessment and industry implications

This incident may pose secondary risks to clients and business partners, given the organization's role in providing B2B services and managing data center operations. Depending on the nature of the leaked data, negative impacts on corporate trade secrets and customer information may be observed. Furthermore, if the ransom is not paid, the public release of the data could lead to reputational damage and operational disruptions for the organization.

Given the nature of the organization, it is likely that the company may face legal obligations within the framework of data protection regulations in Russia. For organizations operating in the technology and managed services sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing strict access controls, maintaining offline backups, and conducting regular security audits to mitigate the risk of unauthorized data exfiltration.

Public information regarding the Werewolves group remains limited, making it difficult to attribute the attack to a specific known entity or to predict their future tactics. The ongoing nature of the negotiations, as claimed by the group, suggests that the situation remains fluid.