Top Highlights
- Berlin’s network was targeted by Rhysida threat actors via compromised valid accounts, ZeroLogon exploits, and phishing, resulting in the exfiltration of at least 5.79 terabytes of sensitive data.
- Threat actors employ double extortion methods, threatening blackmail while demanding ransom, with some attacks linked to the Vice Society group, increasing the risk of widespread ransomware campaigns.
- Manchester Airports’ customer data, including contact and vehicle info, was stolen through unauthorized access to a separate system, posing significant risks of identity theft and fraud, though operational security remains intact.
Threat, Attack Techniques, and Targets
The threat involves hackers attempting extortion after stealing data from Berlin’s state network. The attackers exfiltrated data between August 7 and August 12, 2026. The cybercriminal group Rhysida claims to have taken 5.79 terabytes of data, including personal information of over 12,000 people. They publicly shared a leak site indicating the breach.
Rhysida uses several attack techniques. They gained access by exploiting valid accounts on external remote services, especially where multi-factor authentication (MFA) is not active. They also used a known vulnerability called Zerologon (CVE-2020-1472) to elevate privileges within the network. Additionally, phishing attacks enabled initial access into the victim’s systems. Once inside, they exfiltrate large amounts of data and threaten to leak it unless demands are met.
The targets are primarily Berlin’s government and associated departments. Specifically, data from the Senate Department for Mobility, Transport, Climate Protection and Environment was affected. The threat actors focus on government networks but could potentially target other organizations using similar methods.
Impact, Security Implications, and Remediation Guidance
The data breach has serious implications. The stolen data includes personal and possibly non-public information, which could be misused for identity theft or further attacks. The breach causes a loss of public trust and damages the city’s cybersecurity reputation. It also highlights vulnerabilities in remote access methods and the need for stronger security.
The authorities have warned against paying ransom because it does not guarantee data recovery and encourages further attacks. They recommend fixing known vulnerabilities like Zerologon, enabling multi-factor authentication everywhere, and segmenting networks to contain any breaches.
Remediation guidance is not included here. Therefore, it is recommended to consult the relevant security vendors or authorities for specific steps to improve defenses and respond to this incident.
Expand Your Tech Knowledge
Explore the future of technology with our detailed insights on Artificial Intelligence.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
