Notin Reportedly Hit by Crypto24 Ransomware Attack Five Months After Earlier Incident
Summary
A confidential source told Escudo Digital that Crypto24 used LockBit 5.0 against Notin, affecting about 15 Spanish notaries and disrupting email. Notin's website was down; the company had not responded, and allegedly stolen data and any ransom demand were unknown.
Key points
- Escudo Digital reports a new ransomware attack against Notin, an IT provider to notaries, about five months after an earlier incident.
- A confidential source attributed the new intrusion to Crypto24 and said it used LockBit 5.0; Notin had not responded to the publication's inquiry.
- The source said about 15 notary offices in Spain were affected and their email use was disrupted.
- At publication time, Notin's website returned error 523; the data allegedly held by the attackers and any ransom demand were unknown.
- The article says the Everest group previously claimed to have stolen 145 GB from Notin, including identity documents and notarial records; that claim is attributed to the group.
Article Details
- Victim Organization
- Notin
- Victim Domain
- notin.es
- Incident Type
- Ransomware attack, reportedly involving Crypto24 and Lockbit 5.0
- Operational Impact
- Notin's website was reported unavailable with error code 523. A confidential source said approximately 15 notaries in Spain were affected and that their email service was interrupted. The article does not confirm the extent of disruption.
- Ransom Or Extortion
- The ransom amount, if any, was not disclosed. The article says it was unknown what data the group held.
- Claim Status
- alleged
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe article says Crypto24 typically uses exposed RDP for access; use of RDP in this incident is not confirmed.T1078 · Valid AccountsThe article says Crypto24 typically gains access using stolen credentials; use of this method in the Notin incident is not confirmed.T1486 · Data Encrypted for ImpactThe incident was reported as a ransomware attack. The article says Crypto24 typically encrypts files, but does not confirm the specific encryption activity at Notin.T1562.001 · Disable or Modify ToolsThe article says Crypto24 typically disables security solutions; it does not confirm this behavior in the Notin incident.T1566 · PhishingThe article says Crypto24 typically uses phishing to gain network access; it does not establish that phishing was used in this incident.
Threat Actors
Crypto24The article reports that Crypto24 was responsible for the new ransomware attack on Notin and used Lockbit 5.0 malware. It describes the attribution as information from an exclusive source; specific compromise and data-theft details were not confirmed.EverestThe article says Everest claimed responsibility for an earlier ransomware attack on Notin and claimed to possess 145 GB of company data.