Ransomware Attack on Nalsani SAS (Totto) by LockBit 3.0

Victim Overview

Nalsani SAS, operating under the brand Totto, is a Colombian company specializing in the production and distribution of fashion items such as backpacks, handbags, accessories, and more. The company stands out in the industry for its focus on sustainability, social responsibility, and offering a wide range of durable and stylish products for travel, school, and everyday use.

Company Profile

Totto is a significant industry player with a presence in over 57 countries and more than 600 stores worldwide. The company has over 374 marketing branches in Latin America and employs 1,784 individuals. Totto's eCommerce net sales are primarily generated in Colombia, with a focus on the Fashion category, particularly Bags & Accessories.

Attack Details

LockBit 3.0, a Ransomware-as-a-Service (RaaS) group, targeted Nalsani SAS (Totto) by infiltrating their website, totto.com. Instead of demanding a ransom, the attackers exfiltrated 56 GB of miscellaneous documents and released a sample of the leaked data. This attack showcases the evolving tactics of cybercriminals to exploit vulnerabilities in organizations.

Threat Actor Analysis

The ransomware group distinguishes itself by being an advanced variant of the LockBit ransomware, known for its encryption capabilities, obfuscation techniques, and lateral movement within networks. The group has targeted a wide range of businesses globally, including major companies like Boeing and ICBC. LockBit 3.0's modular and evasive nature makes it challenging to detect and defend against.

Company Vulnerabilities

The attacked company may have been targeted by threat actors due to its significant presence in the fashion industry, extensive network of stores, and online sales platform. The company's focus on sustainability and social responsibility could have made it a target for cybercriminals seeking to exploit sensitive data or disrupt operations.

LockBit May Attacks

This is part of the May 2024 attacks by LockBit 3.0, a cybercriminal group, resurfaced with vigor following the disruption of its infrastructure in February during "Operation Cronos." Despite arrests and the dismantling of its data leak site, LockBit swiftly returned, targeting over 50 victims within hours of reactivating its platform, with subsequent attacks adding to the tally. These assaults spanned various sectors and countries, showcasing LockBit's global reach and adaptability.

Sources:

• Bloomberg - Nalsani SAS Company Profile
• EcommerceDB - Totto Online Store
• Universidad de Bogotá - Totto Industry Presence
• EMIS - Nalsani SAS Company Revenue
• VMware - LockBit 3.0 Information
• SentinelOne - LockBit 3.0 Features
• Trend Micro - LockBit 3.0 Capabilities
• Times of India - LockBit 3.0 Targeted Companies
• Wazuh - Detecting LockBit 3.0 Ransomware