Brain Cipher Claims Responsibility for French Museum Cyberattack

Nearly four weeks after a cyberattack on dozens of French national museums during the Paris Olympics, the ransomware group Brain Cipher has claimed responsibility for the incident. The attack, which targeted the Réunion des Musées Nationaux – Grand Palais (RMN-GP) over August 3-4, focused on systems centralizing financial data for approximately 40 institutions. The group announced they had stolen 300 GB of data and plan to leak it, despite earlier assurances that no data had been exfiltrated. The post includes a countdown timer indicating that the data may be leaked at 20:00 UTC today.

The French cybersecurity agencies ANSSI and CNIL have been alerted and are providing assistance, although they have not offered any new information since the incident was first disclosed on August 6. Brain Cipher is a relatively new group, emerging only in June, and has previously been linked to an attack on an Indonesian national data center affecting over 200 government institutions. Cybersecurity researchers believe that Brain Cipher developed its ransomware using the leaked LockBit 3.0 builder but with more advanced code obfuscation techniques, making it harder to detect and analyze.

SOCRadar noted that Brain Cipher’s ransomware includes several persistence and evasion techniques, such as hiding threads from debuggers and executing in suspended mode to avoid detection. These advanced techniques complicate the control flow, making it difficult for analysis tools to trace the malware’s execution path. Despite these challenges, experts suggest that organizations with robust and regularly updated defenses can still detect and quarantine such attacks before they cause significant damage.

Source: The Register

The European Cyber Intelligence Foundation is a nonprofit think tank specializing in intelligence and cybersecurity, offering consultancy services to government entities. To mitigate potential threats, it is important to implement additional cybersecurity measures with the help of a trusted partner like INFRA www.infrascan.net, or you can try yourself using check.website.