Weekly Darkweb in February W3
2025.02.18
☑️ Weekly Darkweb in February W3, 2025
🔍 Taiwanese PCB Manufacturer Faces Massive Data Breach, linked to Sarcoma Ransomware Gang
• On February 11, it was identified that Taiwanese printed circuit board (PCB) manufacturer company ‘U’ was victimized by ransomware from the Sarcoma ransomware gang.
✓ The company is publicly traded on the Taiwan Stock Exchange, with an annual revenue of approximately USD 3.52 billion in 2024.
✓ The Sarcoma ransomware gang, which emerged in October last year, was one of the most active ransomware gangs in the month.
• The ransomware gang has exfiltrated a total of 377GB of data from the company ‘U,’ with sample data uploaded to the ransomware site.
• Sarcoma threatened to release all of the stolen data on February 20 if negotiations with the victim fail.
🔍 Japanese Plastic Manufacturer Suffers 400GB Data Leak Following Ransomware Attack
• Japanese plastic company ‘J’ has been identified as a recent victim of a ransomware attack carried out by the ‘RansomHub’ group.
✓ The company is listed on the Tokyo Stock Exchange, with an annual revenue of approximately USD 140 billion in 2024.
• The RansomHub ransomware gang has claimed to have stolen around 400GB of data from the victim, and is threatening to release the data on February 17th if negotiations fail.
🔍 Mexican Ministry of Defense Employee Data Shared on Dark Web
• On February 5, it was identified that personal information, including email addresses and names of employees from the Mexican Ministry of Defense (Secretaría de la Defensa Nacional), is being shared on the Dark Web hacking forum ‘BreachForums.’
• Forum user 'OIHEC' emphasizes the rarity of the data, noting that it was stolen by him and not by the Central American indigenous advocacy hacktivist group 'Guacamaya.'
• Previously, in October 2022, the Guacamaya hacking group was allegedly behind a massive breach of the Mexican Ministry of Defense, leaking 6TB of data related to the government agency.
This newsletter is based on news derived from big data collected from over 400 million encrypted pages and channels, including those on the dark web and Telegram.
👉 Subscribe <Weekly Darkweb>: https://bit.ly/4eeDU6I
☎️ Contact us: https://s2w.inc/en/contact
* The full report is available upon request and for XARVIS subscribers.
Attachments
Threat Intelligence Reports
Analysis of the KONNI's LINKON Malware
2025.02.14
Previous
Threat Intelligence Reports
Threat Group Profiling: LockBit
2025.02.21
Next