Brain Cipher claims responsibility for cyberattack on French National Museums

Nearly four weeks after a significant cyberattack on French national museums during the Olympic Games, the ransomware group Brain Cipher has claimed responsibility, announcing plans to leak 300 GB of stolen data later today. The attack, which occurred over August 3-4, targeted institutions overseen by Réunion des Musées Nationaux – Grand Palais (RMN-GP), including the renowned Le Grand Palais.

The cybercriminals reportedly compromised a system used to centralize financial data for approximately 40 institutions under RMN-GP’s management. There was no evidence of data exfiltration at the time of the attack. RMN-GP maintained that the incident did not impact the operational systems used during the Olympic events, including those at Le Grand Palais.

However, Brain Cipher’s recent post on its leak blog suggests otherwise. While the group has not disclosed specifics about the nature of the data, the post includes a countdown timer, indicating that the data will be leaked at 20:00 UTC today.

The attack has drawn the attention of the French cybersecurity and data protection agencies, ANSSI and CNIL. ANSSI confirmed that it is assisting RMN-GP but reiterated that the incident did not affect systems related to the 2024 Olympic and Paralympic Games. Despite repeated inquiries, RMN-GP has not provided further details on the claims made by Brain Cipher.

Brain Cipher, a relatively new player in the ransomware scene, is believed to have developed its malware using the LockBit 3.0 builder, a tool leaked in 2022. This builder has been employed by various emerging ransomware groups, enabling them to launch attacks with minimal preparation. However, Brain Cipher’s payload reportedly includes advanced code obfuscation techniques that complicate detection and analysis, making it more sophisticated than other ransomware strains.