ALTDOS hacking group wreaks havoc across Southeast Asia

guest · Aug 25, 2021

ALTDOS hacking group wreaks havoc across Southeast Asia
August 24, 2021
https://therecord.media/altdos-hacking-group-wreaks-havoc-across-southeast-asia/

Since December 2020, the ALTDOS group has hacked and extorted companies in Bangladesh, Singapore, and Thailand.

Among the group's targets are companies like OrangeTee, 3BB, Audio House, Vhive, CGSEC, and others.

The group has been seen deploying ransomware, extorting companies with stolen data, or selling data on hacking forums.

Click to expand...

First spotted in December 2020, the group has been linked to intrusions at companies in Bangladesh, Singapore, and Thailand.

According to a series of government cybersecurity alerts and reporting done by DataBreaches.net, which has had extensive direct contact and conversations with the group, ALTDOS’ modus operandi can only be described as chaotic.
Click to expand...

In some past instances, the group has been seen deploying ransomware to encrypt a victim’s data, while in others, they only resorted to stealing sensitive information.

Additionally, in some cases, the group engaged with victims and demanded ransom payments, while in others, the group did not bother and simply auctioned or released the victim’s data for free online.

“In the past, they have not asked for the kind of exorbitant ransoms other threat actors have demanded, and in some cases, as we see above, they wind up not making any financial demands at all and just leak the data or advertise it as being for sale,” Dissent, a reporter for DataBreaches.net, described the group’s operations in a June 2021 blog post.
Click to expand...

ALTDOS targets outdated Apache web servers
With the group continuing to make new victims as recently as this month, Singapore officials have released an advisory today detailing the group’s most common tactics.

Per this extensive report, ALTDOS intrusions typically occur after the group exploits a vulnerability in a public-facing web service, with their most common target being Apache web servers.

If victims don’t pay, the data is often leaked online. In the case of larger companies, the ALTDOS group also utilizes DDoS attacks in order to put additional pressure and remind the victim to pay the ransom.
Click to expand...

While the true extent of its operations is still a mystery, some of the group’s largest intrusions that have been documented online include the likes of:
Click to expand...

Country Group Securities (CGSEC) – a Thai financial and stock market company (Dec 2020).

Mono Next Public Company Limited – a Thai mass media company (Jan 2021).

Bangladesh Export Import Company Limited (BEXIMCO) – a multinational conglomerate (Jan 2021).

3BB – an internet service provider in Thailand (Jan 2021).

Vhive – a popular retail furniture chain in Singapore (Mar 2021).

Audio House – a consumer electronics retailer in Singapore (June 2021).

Unispec Group Singapore – a company operating in the marine industry, based in Singapore (June 2021).

OrangeTee – a Singapore-based real estate firm (Aug 2021).

SingCERT: Joint Advisory on ALTDOS

This joint advisory is the result of a collaborative effort between the Cyber Security Agency of Singapore (CSA), the Personal Data Protection Commission (PDPC) and the Singapore Police Force (SPF). It highlights the observed Tactics, Techniques and Procedures (TTPs) employed by ALTDOS to compromise their victims’ networks and provides some recommended measures for organisations to mitigate the threat posed.
Click to expand...

Log in or Sign up

ALTDOS hacking group wreaks havoc across Southeast Asia

guest Guest

Log in or Sign up

ALTDOS hacking group wreaks havoc across Southeast Asia

guest Guest

Useful Searches