Security Incident: Citycomp

On 30 April 2019, Motherboard published an article about a breach at Citycomp, an internet infrastructure provider. A statement from Citycomp said that cybercriminals have "..hacked and blackmailed and the attack is ongoing". The cybercriminals created a website with a Github style directory listing of all of the victims stored in separate folders. Officials from Citycomp have notified affected customers and are working on remediation of the incident.

Recommendations

• In the ZeroFOX platform, enable the Cyber Attack Chatter Rule, and implement a custom rule to monitor for any company-specific leaked technical information
• If you are a Citycomp customer, contact your account managers there for additional information related to the breach
• Reach out to ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

ZeroFOX Alpha Team obtained the website hosting the files, located at https://citycomp[.]de. There is a Github-style directory listing and a README section. The README is as follows:

Who is a Citycomp?
As a multi-vendor service provider, today we maintain over 70,000 servers and storage systems of every type and size in 75 countries. We also support over 500,000 units of clients' hardware (PCs, workstations, printers, cash registers).

Our engineers are specialists in the field of servers and storage. We are also fully skilled in the networks and desktops field. Our engineers spent many years with different manufacturers servicing server and storage system hardware prior to joining CITYCOMP Service GmbH, and received first-class training.

We gradually won our clients' confidence through delivering proven quality and through being client-centred, and they responded by entrusting more and more of their systems to us. Many data-centre operators have appointed us as their strategic partner for safeguarding the operational status of their critical IT systems, and in on-site service situations our engineers deliver IMAC/D/R* and rollout services.

312 570 files in 51 025 folders, over 516 Gb data financial and private information on all clients, include VAG, Ericsson, Leica, MAN, Toshiba, UniCredit, British Telecom and etc..

Downloading of files will be available Apr, 31, 2019


Best regards: imboristheblade@protonmail[.]com

Permanent link: http://snatchvwddns6zto[.]onion (to open via TOR browser)

The email address, imboristheblade@protonmail[.]com, is a known email address associated with the Snatch ransomware. The TOR link also references snatch within the referenced domain. The company mentioned that they were being blackmailed for the information which coincided with previous actions by this actor. At the time of this writing, some of the files are downloadable on the website.