cyber.hendryadrian.com
Cyber Attack & Data Breach · darkwebinformer.com

ByteToBreach Claims National Oil Ethiopia Compromise, 800 GB Data Exfiltration and Ransomware Deployment

· Original article ↗

Summary

ByteToBreach alleges it compromised National Oil Ethiopia, gained Active Directory admin access, exfiltrated over 800 GB of data and deployed ransomware. The claims are not independently verified in the supplied content.

Key points

  • ByteToBreach claims a full infrastructure takeover of National Oil Ethiopia PLC; the supplied content does not independently verify the allegation.
  • The actor says it gained initial access through an Exchange ProxyLogon exploit, then used a Metasploit reverse shell and Ligolo tunneling for lateral movement.
  • The actor claims it obtained Active Directory administrator privileges and harvested internal credentials.
  • The actor alleges it exfiltrated over 800 GB of data, including a 500 GB ERP database and client and employee records.
  • The actor claims Veeam backup infrastructure and the Kaspersky security console were compromised and ransomware was deployed.

Article Details

Victim Organization
National Oil Ethiopia PLC
Incident Type
Alleged infrastructure compromise, data exfiltration, and ransomware deployment
Data Types Exposed
  • ERP database
  • Client records
  • Employee records
Affected Records
Not disclosed
Affected Data Size
ByteToBreach alleges that more than 800 GB was exfiltrated, including a 500 GB ERP database.
Operational Impact
ByteToBreach claims full Active Directory administrator access, internal credential harvesting, compromise of Veeam backup infrastructure and the Kaspersky security console, and ransomware deployment across the environment.
Ransom Or Extortion
Ransomware deployment is claimed; no ransom demand or other extortion details are reported.
Claim Status
claimed

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe actor claims initial access through an Exchange ProxyLogon exploit.

Threat Actors

ByteToBreachClaims responsibility for the compromise, data exfiltration, and ransomware deployment; these activities are reported as the actor’s claims, not independently confirmed.

Products

KasperskyThe actor alleges exfiltration of over 800 GB of data—including a 500 GB ERP database—and reports compromises of Veeam backup infrastructure and the Kaspersky security console.Microsoft Active DirectoryThreat actor ByteToBreach claims a full infrastructure takeover of National Oil Ethiopia PLC, achieving full Active Directory admin access and deploying ransomware after an 8-step intrusion.Microsoft Exchange ServerInitial access was gained through an Exchange ProxyLogon exploit, followed by lateral movement using a Metasploit reverse shell and Ligolo tunneling.VeeamThe actor alleges exfiltration of over 800 GB of data—including a 500 GB ERP database—and reports compromises of Veeam backup infrastructure and the Kaspersky security console.

Tools

LigoloInitial access was gained through an Exchange ProxyLogon exploit, followed by lateral movement using a Metasploit reverse shell and Ligolo tunneling.Metasploit FrameworkInitial access was gained through an Exchange ProxyLogon exploit, followed by lateral movement using a Metasploit reverse shell and Ligolo tunneling.

Countries

EthiopiaThreat actor ByteToBreach claims a full infrastructure takeover of National Oil Ethiopia PLC, achieving full Active Directory admin access and deploying ransomware after an 8-step intrusion.

Related Articles