Compass Group Italia S.p.A (Novembre 2023)

[Claudio]

Info di base:
Comunicato ufficiale: https://compass-group.it/comunicato-inc ... formatico/
Altro:
https://x.com/sonoclaudio/status/172976 ... 24780?s=20


JAMESWT mi segnala in DM che il gruppo attaccante risulta essere AKIRA
Riepilogo della chat:


> Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.

You

> Yes I do

We

> a moment please.

> List.7z // 1.02 MB

> These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

You

> This is safe for open?

We

> Sure.

> Have you reviewed the list? We are waiting for your files request.

You

> I have downloaded the list. I will review it with my team when we are back in the office on Monday. After we finish reviewing it, I will be back here on Monday with 2-3 filenames from the list. Thank you

We

> Standing by.

You

> Hello I will have the filenames soon. Please continue to stand by

We

> Still waiting.

You

> Hi. Can I see these?

> Technical sheet Ditali rigati 47.pdf

> 0154 MILANO 2 INTERAZIENDALE.pdf

> Durc scad. 02.10.2023.pdf

We

> Sure. Will upload soon.

> proof.7z // 256 KB

You

> Hello. Are you doing a DoS attack on us right now?

We

> Hello. No. Why should we do that?

You

> I am not sure, that is why I asked. But ok. We are still looking into the cause of this and once it is resolved we will come back to continue.

We

> We won't wait forever.

You

> The issue seems to be resolved for the moment. Now we would like to review a decryption example. Can you decrypt this file?

> otrs-compass.nvram.akira // 9.13 KB

We

> Yes, I will pass this to my tech dept.

We

> otrs-compass.nvram // 8.62 KB

You

> Thanks, I will check this is intact and get back to you on Monday

We

> Standing by."