Stormous Ransomware Hits Telecom Italia Mobile, Exfiltrates 100GB Data
Incident Date:
August 17, 2024
Overview
Title
Stormous Ransomware Hits Telecom Italia Mobile, Exfiltrates 100GB Data
Victim
Telecom Italia Mobile S.p.A
Attacker
Stormous
Location
First Reported
August 17, 2024
Stormous Ransomware Group Claims Attack on Telecom Italia Mobile S.p.A
Telecom Italia Mobile S.p.A (TIM), a leading telecommunications provider in Italy, has reportedly fallen victim to a ransomware attack by the Stormous group. The cybercriminals claim to have infiltrated TIM's systems, exfiltrating 100GB of sensitive data. This incident underscores the growing threat of ransomware attacks on major corporations.
About Telecom Italia Mobile S.p.A
Telecom Italia Mobile S.p.A, commonly known as TIM, is Italy's largest telecommunications company. With a workforce of approximately 52,000 employees, TIM offers a wide range of services, including mobile and fixed communication, broadband internet, digital TV, and cloud services. The company is recognized for its extensive 4G and 5G network coverage and its commitment to upgrading its infrastructure to enhance service quality and energy efficiency.
TIM's strategic initiatives include transitioning from 3G to 4G and 5G networks, promoting ultrabroadband services through fiber-optic technology, and providing various digital offerings such as cloud services and digital identity solutions. The company also engages in social responsibility initiatives, focusing on digital inclusion and sustainability.
Attack Overview
The Stormous ransomware group has claimed responsibility for the attack on TIM, asserting that they have accessed and exfiltrated 100GB of sensitive data. The group announced the breach on their dark web leak site, highlighting their ability to penetrate the systems of a major telecommunications provider. The exact nature of the compromised data has not been disclosed, but such breaches typically involve customer information, financial records, and proprietary business data.
About the Stormous Ransomware Group
Stormous is a ransomware group known for its pro-Russian stance and claims of high-profile cyberattacks. Active since 2021, the group has targeted entities in the United States, Ukraine, and other countries. They employ double extortion tactics, encrypting victims' data and threatening to leak it if ransom demands are not met. Stormous has recently reactivated its data leak site, featuring a victim list, a marketplace for selling stolen data, and a job application page for recruiting hackers.
Potential Vulnerabilities
As a major telecommunications provider, TIM's extensive infrastructure and large customer base make it an attractive target for ransomware groups. The company's ongoing transition to advanced network technologies, such as 5G, may introduce vulnerabilities that cybercriminals can exploit. Additionally, the integration of various digital services and partnerships with other organizations could create potential entry points for attackers.
Penetration Methods
While the specific methods used by Stormous to infiltrate TIM's systems are not detailed, common tactics include phishing attacks, exploiting unpatched vulnerabilities, and leveraging weak security protocols. The group's ability to execute such an attack suggests a high level of sophistication and coordination, potentially involving insider threats or advanced persistent threats (APTs).
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.