ALPHV compromised the federal state of Carinthia in May alphv…onion. The ransom is said to be around $5 million (Futurezone says euros). The state told Salzburg24 that about 100 of its 3,700 workstations were infected and that it will not pay, since its data sits on backups. They released a first set of files from the breach. DarkFeed spotted Carinthia’s EU liaison office on the leak site, with the group threatening to publish more about government members. The release included passport copies and a large folder on the Hypo bank, and probably stems from the Covid19 test campaign. Futurezone cites researcher Sebastian Bicchi, who reported on Twitter that 5.6 GB of a claimed 250 GB were already leaked, including emails, Covid test records, passport data and visas.
For background, an ALPHV representative told The Record about plans for a ransomware “meta-universe” with outsourced victim calls, DDoS and leak storage for affiliates, and claimed hospitals are off limits. State governments apparently are not. Trend Micro traced one BlackCat intrusion from a ProxyShell web shell on an exposed Exchange server via Cobalt Strike to the Rust payload, spread through SYSVOL.