radiosvet Listed by malas Ransomware Group

On April 9, 2023, radiosvet appeared on the leak site operated by the malas ransomware group, listed among organizations whose internal files had been exfiltrated following a ransomware attack that exploited a Zimbra vulnerability. The listing does not specify how many individuals or records are affected, nor does it detail the exact volume or categories of data taken beyond stating that internal files were stolen.

Details from the Leak-Site Listing

The primary disclosure on the malas leak site indicates that radiosvet suffered a ransomware intrusion in which attackers gained access through an unpatched Zimbra vulnerability. The group claims to have exfiltrated internal files before encrypting systems and now threatens to publish the stolen data unless their demands are met. The listing provides no quantified victim count and does not itemize the specific files or data types beyond the general description of internal documents. Public views of the onion site at the time of listing showed sample screenshots or partial file trees typical of such extortion posts, though the full archive size and sensitivity remain undisclosed by the attackers.

Why This Matters for You and Your Family

When a company that handles personal information experiences a breach like this, your data can quickly become part of a larger chain of exposure. Even if you never directly interacted with radiosvet, related vendors, partners, or shared contacts may have had your details stored in the compromised internal files. Internal files exfiltrated in ransomware attacks frequently contain spreadsheets of customer records, employee rosters, contracts, invoices, or correspondence that include names, addresses, phone numbers, email accounts, and financial details. Once these files circulate on dark-web forums, they fuel identity theft, phishing campaigns, and long-term fraud risks that can affect you and your family for years.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at the initial leak. Stolen internal files often contain enough breadcrumbs—usernames, email addresses, phone numbers, or internal notes—to link your professional identity to personal accounts across the internet. These connections create doxxing chains that let attackers or opportunistic criminals locate social-media profiles, family photos, children’s usernames, and even gaming accounts. A single exposed work email can lead to credential-stuffing attacks on personal services, turning one corporate breach into multiple account takeovers. Credential leaks like this one cascade into account takeovers and doxxing chains, especially when gaming platforms or family-shared logins reuse the same passwords or recovery details found in the stolen files.

Malas Ransomware Group Track Record

Public reporting attributes the malas ransomware group with emerging in late 2022 as a relatively new entrant that relies on opportunistic exploitation of known vulnerabilities rather than highly customized malware. The group has targeted organizations across multiple sectors, typically gaining initial access through vulnerable web-facing applications such as email servers and collaboration platforms. Their standard playbook involves exfiltrating data before deploying encryption, followed by dual extortion: demanding payment to prevent both system restoration and public release of the stolen files. Notable prior victims listed on similar leak sites have included mid-sized businesses and public-sector entities, though exact success rates and ransom-payment outcomes remain opaque. The group’s use of the Zimbra vulnerability in the radiosvet case fits their observed pattern of attacking unpatched, internet-exposed services rather than sophisticated social-engineering campaigns.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this claimed breach may have exposed about you and your family.
• Rotate any password you used at radiosvet or any related service, then enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often become targets when credential leaks create doxxing chains back to the family address.
• Let remediation specialists handle data-broker takedown requests and follow-up monitoring so you do not have to chase every downstream copy of your information yourself.

The radiosvet listing is a reminder that even mid-sized organizations remain high-value targets when they leave known vulnerabilities unpatched. Taking concrete steps now can limit how far this incident reaches into your daily life. Start your DoxxScan trial and let its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage—including children’s gaming accounts—work on your behalf.