FOL 23 Faces Ransomware Breach by APT73 Cybercriminals
Ransomware Attack on Fédération Oeuvres Laïques Creuse: A Closer Look
The Fédération Oeuvres Laïques Creuse (FOL 23), a prominent organization in the Creuse region of France, has recently fallen victim to a ransomware attack allegedly orchestrated by the group known as APT73. This incident underscores the vulnerabilities faced by educational and community-focused organizations in the current cybersecurity landscape.
About FOL 23
FOL 23 is a multifaceted association dedicated to promoting education, sports, civic engagement, cultural events, and leisure activities. With an annual revenue of approximately $20.8 million, the organization plays a significant role in enhancing social engagement and community development in the Creuse region. As part of the broader "Ligue de l'enseignement" network, FOL 23 is committed to advancing secular education and social initiatives. Despite its moderate size, the organization is a key player in its sector, making it an attractive target for cybercriminals.
Details of the Attack
The ransomware group APT73 has claimed responsibility for the attack on FOL 23, asserting that they have exfiltrated sensitive data from the organization. The attackers have released screenshots to substantiate their claims, indicating a breach of the organization's systems. The attack was first reported on January 20, 2025, and the extent of the data leak remains unclear. This incident could potentially disrupt FOL 23's ability to serve the local community effectively.
APT73: A New Threat in the Cybersecurity Landscape
APT73 is a relatively new ransomware group that emerged in late April 2024. The group distinguishes itself by adopting an "APT" designation, typically associated with advanced persistent threats, to project a sophisticated image. Their operational model closely mirrors that of the notorious LockBit group, employing similar tactics such as double-extortion strategies. Despite their amateurish signs, such as lacking active mirrors on their data leak site, APT73 has quickly targeted multiple victims across various sectors, including education and healthcare.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!