Werewolves ransomware group claims data leak involving aek.mk

• Ransomware group: Werewolves
• Country: North Macedonia
• Sector: Technology
• Announcement date: December 20, 2023

Werewolves claims to have leaked data from aek.mk

The threat actor known as Werewolves has listed the organization aek.mk on its dedicated leak site. In the announcement, the group claims to have accessed and shared directory listings belonging to the organization. This type of activity is a hallmark of modern ransomware operations, where attackers often employ double extortion tactics. In such scenarios, threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage, threatening to publish it on public leak sites if their demands are not met.

The announcement, posted on December 20, 2023, includes a screenshot that appears to show various folder names. These directories may point toward internal correspondence or sensitive financial records held by the organization. By publishing these directory structures, the group may be attempting to exert pressure on the organization to fulfill their demands.

Details of the claimed data exposure

The information provided in the leak site announcement suggests that the directories contain a variety of sensitive files. Based on the screenshots provided by the threat actor, the file names indicate the presence of several types of organizational data. Specifically, the directories include names such as 'Audit 2020', 'KPMG - Transition to full IFRS', 'List for insurance', and various other project titles.

The types of data potentially involved in this claim include:

• Financial records
• Audit reports
• Project files

It is important to note that the group has not provided specific details regarding the total size of the data or the exact number of files that were taken. Furthermore, no specific ransom demand has been mentioned in the public announcement.

About aek.mk

AEK (Agencija za elektronski komunikacii) is the official regulatory body for the electronic communications market in North Macedonia. The agency is responsible for developing and implementing regulatory tools designed to ensure that competition within the market remains effective, transparent, and sustainable.

Potential impact and organizational implications

This claimed leak could lead to the exposure of sensitive corporate data within aek.mk. Given that the file names suggest the presence of financial processes and audit records, this incident may create negative impacts on the organization's commercial reputation. Furthermore, the leaked data could potentially be utilized by malicious actors for identity theft or targeted phishing attacks against the organization or its stakeholders.

Under the data protection regulations established in North Macedonia, the organization could face legal obligations and potential investigations by the relevant authorities following such an incident. While public information regarding the Werewolves group remains limited, their actions highlight the ongoing risks faced by regulatory bodies.

Organizations in the technology and regulatory sectors can take several defensive steps to mitigate the risks associated with ransomware and data exfiltration. Implementing robust data encryption for files at rest and in transit can help ensure that even if data is stolen, it remains unreadable to unauthorized parties. Additionally, maintaining strict access controls and following the principle of least privilege can limit the ability of an attacker to move laterally through a network to find sensitive directories. Regular security audits and monitoring of network traffic can also assist in the early detection of unauthorized data movement.