Threat Actor Claims Ransomware Attack and Data Theft at National Oil Ethiopia

Summary

A threat actor claims to have breached National Oil Ethiopia through an Exchange ProxyLogon vulnerability, disabled Kaspersky, compromised Veeam backups, deployed ransomware and stolen four databases, including an ERP database over 800GB.

Key points

A threat actor on a hacker forum claims an eight-step intrusion against National Oil Ethiopia PLC; the article provides no independent confirmation.
The actor claims initial access came through an Exchange ProxyLogon vulnerability.
The actor says they escalated privileges, disabled Kaspersky security software and compromised Veeam backups.
The claimed attack involved ransomware deployment across the network.
The actor claims four databases were exfiltrated, including an ERP database larger than 800GB.

Article Details

Victim Organization: National Oil Ethiopia PLC
Incident Type: Alleged data breach and ransomware attack
Data Types Exposed: Four databases, including an ERP database
Affected Data Size: The ERP database was reportedly over 800GB; the size of the other databases was not disclosed.
Operational Impact: The threat actor claimed ransomware was deployed across the network. Specific operational disruption was not reported.
Ransom Or Extortion: Ransomware deployment was claimed; no ransom demand or extortion details were disclosed.
Claim Status: claimed

Vendors

KasperskyThe attacker says they exploited an Exchange ProxyLogon vulnerability to escalate privileges, disable Kaspersky, compromise Veeam backups, deploy ransomware, and exfiltrate four databases including an ERP database of Veeamthey exploited an Exchange ProxyLogon vulnerability to escalate privileges, disable Kaspersky, compromise Veeam backups, deploy ransomware, and exfiltrate four databases including an ERP database of over 800GB.

Products

KasperskyThe attacker says they exploited an Exchange ProxyLogon vulnerability to escalate privileges, disable Kaspersky, compromise Veeam backups, deploy ransomware, and exfiltrate four databases including an ERP database of Microsoft Exchange ServerThe attacker says they exploited an Exchange ProxyLogon vulnerability to escalate privileges, disable Kaspersky, compromise Veeam backups, deploy ransomware, and exfiltrate four databases including an ERP database of Veeamthey exploited an Exchange ProxyLogon vulnerability to escalate privileges, disable Kaspersky, compromise Veeam backups, deploy ransomware, and exfiltrate four databases including an ERP database of over 800GB.

Countries

EthiopiaNational Oil Ethiopia PLC (NOC) reportedly suffered a major data breach and ransomware attack after a threat actor detailed an eight-step intrusion on a hacker forum.