CERT.lv Reports Unauthorized Access to Olpha Server; Investigation Continues

Summary

CERT.lv found that an attacker who also targeted Latvijas valsts meži accessed an Olpha server; the incidents are not technically linked. Logs were deleted, no encryption was observed, and Olpha contained the damage as analysis continues.

Key points

• CERT.lv reported unauthorized access to at least one Olpha information system.
• CERT.lv identified the same attacker in the Olpha and Latvijas valsts meži incidents, but said the incidents were not technically linked.
• Evidence logs were deleted during the Olpha intrusion.
• No data encryption was observed.
• Olpha contained the damage; the investigation and analysis are ongoing.
• CERT.lv warned that financially motivated threat groups remain active in Latvia and published indicators to help organizations defend themselves.

Countries