Threat Actor Claims Mobi UZ Corporate Network Compromise
Summary
A threat actor claims to have compromised about 280 Mobi UZ machines and stolen customer, business, and employee data. The reported access methods and impacts are unverified.
Key points
- The threat actor claims administrative access to about 280 Active Directory-joined machines and systems including SMS gateways, mail, billing, Veeam, MYID, and MinIO repositories.
- The claimed access methods include EternalBlue, NetScaler SessionID disclosure (CVE-2024-6235), and an ADCS ESC1 misconfiguration.
- The actor claims to have taken customer registration data, ID documents, business and financial records, and eight databases.
- The article reports that personal information belonging to about 3,000 employees was affected; this is not independently verified in the supplied content.
- Mobi UZ reportedly paid an initial €35,000 to delay publication while assessing the incident.
Article Details
- Victim Organization
- Mobi UZ (UMS)
- Incident Type
- Alleged corporate network compromise and data theft
- Data Types Exposed
- Customer registration information
- Customer ID documents and photographs
- Business client information
- Financial data
- Employee personal information
- Affected Records
- Approximately 3,000 employees' personal information; the number of other affected records was not disclosed.
- Affected Data Size
- The actor reportedly claimed to have obtained eight databases; total data size was not disclosed.
- Operational Impact
- The actor claimed full administrative access to approximately 280 Active Directory-joined machines and critical systems, including SMS gateways, replication servers, mail systems, billing services, facial recognition systems, and on-premises repositories. The compromise and impact are reported, not independently confirmed in the article.
- Ransom Or Extortion
- Mobi UZ reportedly made an initial payment of €35,000 to delay publication of stolen data while assessing the incident; this payment is reported, not confirmed.
- Claim Status
- claimed
MITRE ATT&CK
T1210 · Exploitation of Remote ServicesThe threat actor claimed to have used EternalBlue to gain access; the article does not independently confirm the claimed activity.T1649 · Steal or Forge Authentication CertificatesThe threat actor claimed to have exploited an ADCS ESC1 admin certificate misconfiguration; the article does not independently confirm the claimed activity.
CVE
Products
1CStolen data reportedly includes customer registrations, ID documents with photographs, business client information, financial data from 1C, and eight databases across Oracle, PSQL, and MySQL.MinIOVeeam replication servers, mail systems, billing services, MYID facial recognition, and on-premises Minio S3 repositories.MYIDover critical systems such as SMS gateways, Veeam replication servers, mail systems, billing services, MYID facial recognition, and on-premises Minio S3 repositories.MySQLStolen data reportedly includes customer registrations, ID documents with photographs, business client information, financial data from 1C, and eight databases across Oracle, PSQL, and MySQL.NetScalerThe threat actor claims to have exploited EternalBlue, NetScaler SessionID disclosure (CVE-2024-6235), and an ADCS ESC1 admin certificate misconfiguration to exfiltrate customer registrations, ID documents with photos,OracleStolen data reportedly includes customer registrations, ID documents with photographs, business client information, financial data from 1C, and eight databases across Oracle, PSQL, and MySQL.PSQLStolen data reportedly includes customer registrations, ID documents with photographs, business client information, financial data from 1C, and eight databases across Oracle, PSQL, and MySQL.Veeammachines and granting attackers administrative control over critical systems such as SMS gateways, Veeam replication servers, mail systems, billing services, MYID facial recognition, and on-premises Minio S3