Who Is MONTY? ;) targeted by MONTI ransomware group

• Ransomware group: Donutleaks
• Announcement date: November 10, 2023

MONTI ransomware group targets Who Is MONTY? ;)

The MONTI ransomware group has officially listed the organization Who Is MONTY? ;) on a dedicated leak site. This announcement, posted on November 10, 2023, marks a public escalation in the conflict between the threat actors and the targeted entity. The listing serves as a public declaration of the group's intent and their claims regarding the security status of the organization.

Claims of non-payment and credential exposure

According to the announcement published by the MONTI group, the incident stems from a failed negotiation. The threat actors claim that Who Is MONTY? ;) failed to fulfill a payment agreement amounting to 100,000 USD. The group alleges that the attack occurred around September 1, 2023, though this date represents the group's claim rather than a verified fact.

As part of their pressure tactics, the MONTI group has released information intended to discredit the organization. The threat actors allegedly shared login credentials that are purported to belong to the organization's administrative panel. This tactic is a common feature of modern ransomware operations, where the goal is not just to encrypt data, but to publicly humiliate the victim to force compliance with ransom demands.

The organization has responded to these claims by denying that any such breach has occurred. Representatives for the organization have stated that their systems remain isolated and that no data breach has taken place. Furthermore, the organization has asserted that the login credentials shared by the MONTI group are non-functional, disputing the validity of the information provided by the attackers.

Details of the alleged data leak

The announcement made by the MONTI group includes specific claims regarding the nature of the information they have obtained. The primary content shared by the threat actors involves the aforementioned administrative credentials.

• Alleged login credentials for an administrative panel

The listing does not provide specific details regarding the total volume of data or the specific number of files involved in the alleged breach.

Analysis and implications of the incident

This incident highlights a specific tactic utilized by ransomware groups: the leaking of administrative access credentials to exert maximum pressure on a victim. By releasing information that appears to grant access to internal systems, threat actors aim to demonstrate their capability and damage the reputation of the target. This strategy is often used in double extortion schemes, where attackers threaten to release sensitive data if a ransom is not paid.

The discrepancy between the group's claims and the organization's denial suggests a potential dispute or a situation involving misinformation. Such public accusations can lead to significant reputational damage for the organization and may potentially expose the entity to secondary attacks from other threat actors monitoring the situation.

While information regarding the MONTI group remains limited, this incident underscores the importance of robust incident response plans. If a breach is eventually confirmed, the organization may face significant regulatory obligations concerning data privacy and security. Organizations facing similar threats should prioritize the isolation of critical systems, the implementation of multi-factor authentication, and continuous monitoring of administrative access to mitigate the impact of such extortion attempts.