InfoSecBulletin Cybersecurity for mankind
“A threat actor has reportedly claimed to gain root-level access to Titas Gas’s firewall server and is actively offering this access for sale on the dark web, posing a serious risk to Bangladesh’s energy infrastructure”.
Bangladesh Cyber Security Intelligence (BCSI) reported that someone has reportedly gained unrestricted access to Titas Gas’s firewall server, allowing them potential entry into the company’s broader network. The threat actor is offering this access for $1,000, with the price expected to rise as they reach more critical servers and infrastructure.
CVE-2024-51503
Trend Micro released updates for Deep Security Agent RCE
Apple Releases Patch for two Actively Exploited Zero-Day
Maxar Space Data Leak, Company admit, Investigation ongoing!
GitHub CLI Vulnerability Could Allow RCE
“Sarcoma” ransomware group
Hacker to disclose “Popular Life Insurance” 36 GB of stolen data
BugHunt 2024: A Milestone Cyber security Competition held at Dhaka
TP-Link DHCP Vulnerability Allow Attackers Takeover Routers Remotely
WSJ reports
T-Mobile hacked in massive breach of telecom networks
Palo Alto Networks Confirms critical RCE zero-day actively exploited
CISA, FBI Warns
Hacker compromised multiple teleco network at US
The hacker’s access presents serious data security risks for Titas Gas, which holds sensitive information such as names, mobile numbers, addresses, gas usage data, and classified documents about national minerals. This could potentially expose private customer data and crucial national resource information to malicious entities.
If the hacker’s claim about controlling the firewall server is true, they could intercept or alter communications within Titas Gas, possibly introducing malware or ransomware. This could disrupt operations, cause gas shortages, and undermine Bangladesh’s energy distribution, endangering both economic stability and national security.
If the hacker’s claimed reportedly to be valid to gain access to other systems, It could disrupt vital infrastructure, affect gas delivery, or hold critical systems for ransom. This threat impacts not only financial and data security but also Bangladesh’s national energy security.
Gas distribution interruptions, especially on a large scale, could lead to substantial losses in revenue for Titas and create energy supply issues for millions of Bangladeshi citizens and businesses. Industries reliant on natural gas, including manufacturing and transportation, could suffer disruptions, with broader impacts on the economy.
BCSI urges Titas Gas and the Bangladeshi government to act urgently to protect critical assets. Immediate actions like firewall audits, improved monitoring, and threat detection are necessary to identify unauthorized access. Incident response teams must collaborate with cybersecurity experts to manage the threat, strengthen defenses, and review security protocols to prevent future breaches.
Titas Gas, one of the primary natural gas suppliers in Bangladesh, is responsible for distributing gas to millions of residential and commercial customers. The company’s role is pivotal in Bangladesh’s energy sector, and any disruption could have widespread repercussions for both its customers and the nation’s economic stability.
Titas Gas provides services to around 2.88 million users in Bangladesh as of June 30, 2023. In the fiscal year 2022-23, it earned ৳26,387.12 crore (approximately $2.5 billion) and contributed ৳706.92 crore (about $68 million) to the national treasury. Titas plays a crucial role in the country’s energy sector and economic growth.
Infosecbulletin will continue to monitor the situation closely and provide updates while more info becomes available.
Thursday (31 October) Bangladesh Bank issues alert on cyber threat for the financial sector as some banks customers are victim to unauthorized transaction through Facebook ad manager. In this situation, Bangladesh Bank notifies the banks to take precautionary action to secure the account as well as advise to take stern action to protect users digital asset.
(Media Disclaimer: This report is based on research conducted internally and externally using different ways. The information provided is for reference only, and users are responsible for relying on it. Infosecbulletin is not liable for the accuracy or consequences of using this information by any means)
