Onubo s.r.l. Listed by Malas Ransomware Group

On April 09, 2023, Italian company Onubo s.r.l. appeared on the leak site operated by the malas ransomware group. The listing states that internal files were exfiltrated during a ransomware attack that leveraged a Zimbra vulnerability. The disclosure does not quantify how many individuals are affected, nor does it list specific data types beyond the broad category of internal files.

Details from the Leak Site

The primary disclosure on the malas leak site indicates that Onubo s.r.l. suffered a ransomware intrusion in which attackers gained access through an unpatched Zimbra collaboration suite vulnerability. The group claims to have exfiltrated internal files before encrypting systems. As is typical with many such listings, the leak site does not detail the volume of data taken or name the exact files involved. The posting includes a deadline for payment, after which samples or all stolen data would be published. Public reporting on similar incidents shows that Zimbra zero-days and unpatched instances have been a reliable initial-access vector for ransomware operators throughout 2022 and 2023.

Why This Matters for You and Your Family

When a company that holds personal information about customers, suppliers, or business partners is breached, your data can end up in the hands of criminals. Even if the leak site listing does not specify what was taken, internal files at a services firm frequently contain names, addresses, tax identifiers, contracts, email correspondence, and financial details. Any of these can be used to impersonate you, file fraudulent taxes, or open accounts in your name. For families, a single breach can expose both parents and children if household records or school-related documents were stored in the compromised environment.

Internal files exfiltrated means the exposure is not limited to a simple list of email addresses; it can include documents that reveal far more about daily life, finances, and relationships.

Doxxing and Identity-Chain Risks

Stolen internal files often contain enough fragments to link disparate online handles, personal email accounts, phone numbers, and physical addresses. Attackers and data brokers routinely combine these fragments into identity chains that follow you across platforms. A seemingly harmless spreadsheet can tie your work email to a personal gaming username, a child’s school login, or a family member’s social-media profile. Once assembled, these chains fuel doxxing campaigns, targeted phishing, and account takeovers that cascade from one service to the next. Credential leaks of this nature frequently surface later on underground forums, extending the window of risk long after the initial ransomware posting.

The Malas Ransomware Group’s Track Record

Public reporting attributes the malas ransomware group with activity that emerged in late 2022. The group has targeted organizations across Europe and Latin America, typically listing victims on its dark-web site after exfiltrating data and deploying encryption. Their playbook relies on known vulnerabilities such as Zimbra, VPN appliances, and remote-desktop services for initial access, followed by claimed exfiltration of internal documents before encryption. Like many mid-tier ransomware operations, malas combines automated tooling with manual data theft and uses double-extortion tactics: threatening both system downtime and public release of stolen files. The group’s leak site continues to publish new victims on a regular basis, indicating sustained operational capacity.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can break chains before criminals exploit them.
• Rotate any password you used at Onubo s.r.l. or related services and replace it with a unique passphrase at every other site where it was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught within hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle data-broker takedown requests and opt-out processes that would otherwise consume hundreds of hours of your own time.

The Onubo s.r.l. incident is a reminder that ransomware groups continue to exploit known vulnerabilities in widely used software while quietly harvesting internal files that can expose ordinary families for years. Starting with a DoxxScan gives you both immediate visibility into your current exposure and ongoing defense against the identity-chain attacks that follow these breaches. Its continuous monitoring, AI-powered mapping, and hands-on remediation specialists—including coverage for children’s gaming accounts—provide the practical protection needed when corporate defenses fail.