InfoSecBulletin Cybersecurity for mankind
“A threat actor has reportedly claimed to gain root-level access to Titas Gas’s firewall server and is actively offering this access for sale on the dark web, posing a serious risk to Bangladesh’s energy infrastructure”.
Bangladesh Cyber Security Intelligence (BCSI) reported that someone has reportedly gained unrestricted access to Titas Gas’s firewall server, allowing them potential entry into the company’s broader network. The threat actor is offering this access for $1,000, with the price expected to rise as they reach more critical servers and infrastructure.
CVE-2025-2492
ASUS warns of critical auth bypass flaw in routers
16,000+ Fortinet devices compromised with symlink backdoor, Mostly in Asia
Patch now! Critical Erlang/OTP SSH Vuln Allows UCE
CISA warns of increasing risk tied to Oracle legacy Cloud leak
CVE-2025-20236
Cisco Patches Unauthenticated RCE Flaw in Webex App
Apple released emergency security updates for 2 zero-day vulns
Oracle Released Patched for 378 flaws for April 2025
CVE-2025-24054
Hackers Exploiting NTLM Spoofing Windows Vuln the in Wild
Bengaluru firm got ransomware attack, Hacker demanded $70,000
MITRE warns: U.S. Govt. Funding for MITRE’s CVE Ends Today
The hacker’s access presents serious data security risks for Titas Gas, which holds sensitive information such as names, mobile numbers, addresses, gas usage data, and classified documents about national minerals. This could potentially expose private customer data and crucial national resource information to malicious entities.
If the hacker’s claim about controlling the firewall server is true, they could intercept or alter communications within Titas Gas, possibly introducing malware or ransomware. This could disrupt operations, cause gas shortages, and undermine Bangladesh’s energy distribution, endangering both economic stability and national security.
If the hacker’s claimed reportedly to be valid to gain access to other systems, It could disrupt vital infrastructure, affect gas delivery, or hold critical systems for ransom. This threat impacts not only financial and data security but also Bangladesh’s national energy security.
Gas distribution interruptions, especially on a large scale, could lead to substantial losses in revenue for Titas and create energy supply issues for millions of Bangladeshi citizens and businesses. Industries reliant on natural gas, including manufacturing and transportation, could suffer disruptions, with broader impacts on the economy.
BCSI urges Titas Gas and the Bangladeshi government to act urgently to protect critical assets. Immediate actions like firewall audits, improved monitoring, and threat detection are necessary to identify unauthorized access. Incident response teams must collaborate with cybersecurity experts to manage the threat, strengthen defenses, and review security protocols to prevent future breaches.
Titas Gas, one of the primary natural gas suppliers in Bangladesh, is responsible for distributing gas to millions of residential and commercial customers. The company’s role is pivotal in Bangladesh’s energy sector, and any disruption could have widespread repercussions for both its customers and the nation’s economic stability.
Titas Gas provides services to around 2.88 million users in Bangladesh as of June 30, 2023. In the fiscal year 2022-23, it earned ৳26,387.12 crore (approximately $2.5 billion) and contributed ৳706.92 crore (about $68 million) to the national treasury. Titas plays a crucial role in the country’s energy sector and economic growth.
Infosecbulletin will continue to monitor the situation closely and provide updates while more info becomes available.
Thursday (31 October) Bangladesh Bank issues alert on cyber threat for the financial sector as some banks customers are victim to unauthorized transaction through Facebook ad manager. In this situation, Bangladesh Bank notifies the banks to take precautionary action to secure the account as well as advise to take stern action to protect users digital asset.
(Media Disclaimer: This report is based on research conducted internally and externally using different ways. The information provided is for reference only, and users are responsible for relying on it. Infosecbulletin is not liable for the accuracy or consequences of using this information by any means)
