ShadowByt3$ Claims Data Theft and Ransom Demand Against Forestal Atlántico Sur
Summary
ShadowByt3$ claims it exfiltrated about 9.24 GB from Forestal Atlántico Sur’s S3 buckets and Azure blobs, threatens to sell the data, and set a 72-hour ransom-negotiation deadline. The claims are unconfirmed in the article.
Key points
- ShadowByt3$ claims it scraped Forestal Atlántico Sur’s S3 buckets and Azure blobs and took approximately 9.24 GB of data.
- The group reportedly set a 72-hour deadline for ransom negotiations and threatened to sell the data.
- The group alleges the data includes PostgreSQL backups from 2018 through May 2023.
- Allegedly exposed records include employee and contractor identities, government ID numbers, employment details, and medical information.
- The claimed data also includes export and logistics records, customer and timber-pricing information, GPS coordinates, equipment logs, and safety manuals.
- The article provides the group’s allegations but no independent confirmation of access, exfiltration, or the data’s authenticity.
Article Details
- Victim
- Forestal Atlántico Sur (FAS)
- Encryption Status
- Unknown; the source does not report whether files were encrypted.
- Exfiltration Status
- ShadowByt3$ claims exfiltration; the claim is not independently confirmed.
- Exfiltrated Data
- The group reportedly claimed to take database backups, employee and contractor records, medical information, logistics and export logs, pricing and customer data, GPS coordinates, equipment logs, and safety and compliance manuals.
- Exfiltrated Size
- Approximately 9.24 GB, according to ShadowByt3$.
- Ransom Demand
- The group reportedly issued a 72-hour deadline to negotiate; no monetary amount is reported.
- Leak Status
- ShadowByt3$ threatened to sell the data if demands were ignored; no publication is reported.
MITRE ATT&CK
Threat Actors
Products
AzureThe ShadowByt3$ group claims to have breached Forestal Atlántico Sur and exfiltrated approximately 9.24 GB of data by scraping the company’s S3 buckets and Azure blobs.PostgreSQLCompromised material reportedly includes complete PostgreSQL database backups from 2018 to May 2023.S3The ShadowByt3$ group claims to have breached Forestal Atlántico Sur and exfiltrated approximately 9.24 GB of data by scraping the company’s S3 buckets and Azure blobs.
Industries
ForestryThe ShadowByt3$ ransomware group claims to have breached Forestal Atlántico Sur (FAS), a prominent Uruguayan forestry and timber export company.TimberStolen operational files reportedly cover logistics and export logs, timber pricing and customers, GPS coordinates of forest plots, and equipment logs.