Orange Spain Network Faces Disruption Due to Infostealer Malware and Weak Password

Orange Spain, the country’s second-largest network provider, experienced a significant outage affecting around half of its network’s traffic. The disruption was attributed to a weak password exposed by infostealer malware, leading to a breach of Orange Spain’s RIPE (Réseaux IP Européens) account.

RIPE is a regional database containing IP addresses and their owners in Europe, the Middle East, and Central Asia. An individual operating under the alias “Snow” claimed responsibility for the attack, sharing screenshots detailing the method used.

Researchers determined that the RIPE account was accessed after the attacker harvested admin credentials using infostealer malware, which had infected the account of an Orange Spain employee. The compromised password was identified as “ripeadmin,” characterized as “ridiculously weak” by security experts.

The breach allowed the attacker to manipulate Orange Spain’s border gateway protocol (BGP) traffic, resulting in a service outage for customers. The autonomous system (AS) number associated with Orange Spain’s IP address and route origin authorizations (ROAs) were modified, disrupting BGP routing.

Notably, RIPE lacks mandatory two-factor authentication (2FA) or multi-factor authentication (MFA), unlike its North American counterpart, ARIN, which mandated such measures in February 2023.

Despite the incident, Orange Spain confirmed that no customer or client data was compromised, and the disruption only affected its services. Following the breach, Snow documented the attack via a newly created X account, prompting Orange Spain to acknowledge the incident and restore service shortly afterward.

Security experts anticipate a potential increase in similar attacks on RIPE accounts, considering the availability of credentials on infostealer marketplaces. Orange Spain has since taken measures to prevent a recurrence of such incidents.

Stay informed with supply chain news on The Supply Chain Report. Free tools for international trade are at ADAMftd.com.

#OrangeSpain #CyberSecurity #DataBreach #RIPE #InfostealerMalware #BGP #NetworkOutage #SecurityIncident #WeakPasswords #2FA #MFA #TechNews