InfoSecBulletin Cybersecurity for mankind
“A threat actor has reportedly claimed to gain root-level access to Titas Gas’s firewall server and is actively offering this access for sale on the dark web, posing a serious risk to Bangladesh’s energy infrastructure”.
Bangladesh Cyber Security Intelligence (BCSI) reported that someone has reportedly gained unrestricted access to Titas Gas’s firewall server, allowing them potential entry into the company’s broader network. The threat actor is offering this access for $1,000, with the price expected to rise as they reach more critical servers and infrastructure.
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems
Paraguay 7.4 Million Citizen Records Leaked on Dark Web
High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation
SoftBank: Over 137,000 personal info leaked
Alert
Trend Micro Apex One Flaw Allow Attackers to Inject Malicious Code
The hacker’s access presents serious data security risks for Titas Gas, which holds sensitive information such as names, mobile numbers, addresses, gas usage data, and classified documents about national minerals. This could potentially expose private customer data and crucial national resource information to malicious entities.
If the hacker’s claim about controlling the firewall server is true, they could intercept or alter communications within Titas Gas, possibly introducing malware or ransomware. This could disrupt operations, cause gas shortages, and undermine Bangladesh’s energy distribution, endangering both economic stability and national security.
If the hacker’s claimed reportedly to be valid to gain access to other systems, It could disrupt vital infrastructure, affect gas delivery, or hold critical systems for ransom. This threat impacts not only financial and data security but also Bangladesh’s national energy security.
Gas distribution interruptions, especially on a large scale, could lead to substantial losses in revenue for Titas and create energy supply issues for millions of Bangladeshi citizens and businesses. Industries reliant on natural gas, including manufacturing and transportation, could suffer disruptions, with broader impacts on the economy.
BCSI urges Titas Gas and the Bangladeshi government to act urgently to protect critical assets. Immediate actions like firewall audits, improved monitoring, and threat detection are necessary to identify unauthorized access. Incident response teams must collaborate with cybersecurity experts to manage the threat, strengthen defenses, and review security protocols to prevent future breaches.
Titas Gas, one of the primary natural gas suppliers in Bangladesh, is responsible for distributing gas to millions of residential and commercial customers. The company’s role is pivotal in Bangladesh’s energy sector, and any disruption could have widespread repercussions for both its customers and the nation’s economic stability.
Titas Gas provides services to around 2.88 million users in Bangladesh as of June 30, 2023. In the fiscal year 2022-23, it earned ৳26,387.12 crore (approximately $2.5 billion) and contributed ৳706.92 crore (about $68 million) to the national treasury. Titas plays a crucial role in the country’s energy sector and economic growth.
Infosecbulletin will continue to monitor the situation closely and provide updates while more info becomes available.
Thursday (31 October) Bangladesh Bank issues alert on cyber threat for the financial sector as some banks customers are victim to unauthorized transaction through Facebook ad manager. In this situation, Bangladesh Bank notifies the banks to take precautionary action to secure the account as well as advise to take stern action to protect users digital asset.
(Media Disclaimer: This report is based on research conducted internally and externally using different ways. The information provided is for reference only, and users are responsible for relying on it. Infosecbulletin is not liable for the accuracy or consequences of using this information by any means)
