Case Study

Extortion Ransomware
(Lockbit 3.0 @ Lockbit Black)

Malaysia Govt Key Sector

(Ministry of Accountancy)

© Copyright IBM Corp. 2023

 Examples: Ransomware, DDOS and Data Theft.

1. Suspicious Email Phishing, a group of hacker with a codename

“grey hat” broke into civil servant e-Penyata Gaji (ePaySlip)
system and extracted nearly two million Civil Servants Employee
payslip and tax form in PDF Format.

2. A government Loopholes of ePaySlip on the system. About

188.75 gigabytes were extorted through Dark Web by given times.
Attack Category:
Extortion
Sources: New Straits Times
Ransomware “Action being taken over alleged hacking of govt database, says
Annuar Musa”

https
://www.nst.com.my/news/nation/2022/09/832056/action-being-taken-over-allege
d-hacking-govt-database-says-annuar-musa
 ePenyata @ ePayslip by Malaysian Govt Sector.
- The data include most of Politicians and other Civil Servants
Employee Payslip.
- The hackers also claimed to have been in contact with the
government through an email sent to several officials.
- Following that, the group of hacker codename “grey hat”
planned to sell the data to Dark Web extracted from the
ePaySlip database on several open database markets starting
Ministry of Sept 19.
- The “grey hat” also claimed to have been in contact with the
Accountancy – government through an email sent to several officials,
188.75gb Data including the Chief Secretary to the Government Tan Sri Mohd
Theft and System Zuki Ali, government security director-general Rahimi Ismail
as well as the National Audit Department.
Loopholes
Vulnerabilities.
 Event 1
1 A Loophole of the Ministry of Accountancy system Vulnerabilities founded by
“grey hat”.

Event 2
2 Extortion by time given into the Dark Web, Social Engineering towards
government security director

Event 3
3 The Hacker planned to sell the data extracted from the ePaySlip database on
several open database markets (Dark Web)
Timeline
Event 4
4 JSON, CSV and PDF file format being extracted with the help of the System
Vulnerabilities.

Event 5
5 By time given, the issue has no update from Media.

Event 6
6 Ministry of Accountancy Database system inoperable / Shutdown due to
Forensic Analysis.
Vulnerabilities
Security Compliance within the Organization which allow the Lockbit Black Breach and Social Engineering
occur which cause the data Extortion.

Ransomeware Compliance No Data Loss Operation Timeframe

(Lockbit 3.0) Insufficient Prevention were in Extranet
Social Engineering, lack No “Zero Trust” policy, Lack of DLP Applied,
of Security Training lack of “Trust no one, there is no Dummy System were exposed
amongst employee, the always verify”. System to replicate, the into extranet which
extortion has been said attack was directly into allowing the access to
to be happen within the the centralize system everyone.
organization. within no services
timeframe.
 Costs Prevention

• 1. Service Downtime due to • 1. Apply DLP Protection

Forensic Analyzing
• 2. File Integrity Check
• 2. 188.75GB of Employee Data at
• 3. Data Encryption
stake.
• 4. Minimize or Exclude the services
Costs and • 3. Trust Issue within the
operation into Extranet within
Prevention organization cause from Lack of
timeframe of a services.
Security Training.