Ransomware Claims Emerge Amid Ongoing Colt Outages

Colt Technology Services, a multinational telecommunications company based in the UK, has reported widespread disruptions to its customer portal and support services, citing a “cyber incident” as the root cause. This incident has resulted in service outages for several days, raising concerns over its potential implications for customer data security.

Commencing in the week of August 12, Colt detected issues within an internal system that have rendered services such as Colt Online and the Voice API platform unavailable. According to the company, the compromised system is distinct from its customers’ infrastructure, although details remain scarce about the precise data at risk.

Claiming responsibility for the attack, the WarLock ransomware group asserted that they have extracted “1 million documents” from Colt. On their dark web leak platform, they indicated that the stolen files encompass sensitive information, including employee salary details, customer contact data, internal executive information, and correspondence. The group has set a ransom demand of $200,000 for the data. A member of the gang, identified as “cnkjasdfgd,” reiterated these claims on an online criminal forum, as reported by Bleeping Computer.

In response to the breach, Colt has proactively shut down affected services and announced that its technical team is focused on restoring normal operations. As of August 14, the company stated it is collaborating with third-party cybersecurity experts to resolve the issues at hand. Despite the disruptions, Colt indicated it retains the capability to monitor customer networks, albeit through manual processes until automated monitoring is fully functional again.

Colt operates an extensive network of metropolitan services across 30 countries, including regions in Europe, Asia, and North America. Notably, cybersecurity expert Kevin Beaumont has investigated a file list reportedly containing 400,000 files that may have been stolen in the attack. Beaumont confirmed the authenticity of these file names, which include documentation related to customers as well as employee performance reviews.

Heightened concerns have emerged regarding potential vulnerabilities exploited during the attack, particularly flaws in on-premise instances of Microsoft SharePoint, known as ToolShell. Microsoft’s security research has previously flagged threats from a group identified as Storm-2603, which this incident may implicate. Notably, Colt’s exposure of the domain sharehelp.colt.net to the internet raises questions about the security protocols in place before the breach.

This incident highlights critical sections of the MITRE ATT&CK Framework, particularly tactics like initial access, which may have been achieved through exploiting known vulnerabilities, and persistence, where attackers maintain footholds within affected systems. Organizations must remain vigilant and proactive in their cybersecurity measures to mitigate the risks posed by such sophisticated threats.