Altron reported that Netstar processed over 226 billion data points between 1 March 2024 and 28 February 2025, and has scaled its fleet to over 33,000 assets globally.<\/p>\n\n\n\n
According to cybersecurity firm Check Point, INC Ransom first emerged in July 2023 and had publicly announced the successful infiltration of 12 victims by September of that year.<\/p>\n\n\n\n
INC Ransom targets vulnerabilities in business services or uses a series of spear-phishing campaigns to compromise user credentials.<\/p>\n\n\n\n
Once threat actors have access to a company\u2019s systems, they use the compromised accounts to perform several forms of system scanning.<\/p>\n\n\n\n
They will search for other vulnerabilities in the ecosystem, scanning networks, domains, and other connected network devices.<\/p>\n\n\n\n
Using compromised accounts, the group will inspect documents, images, and the contents of folders to ensure there is valuable data in the system.<\/p>\n\n\n\n
INC Ransom then extracts other available login credentials and accesses multiple company systems, networks, and accounts.<\/p>\n\n\n\n
Once they have access to numerous devices and systems in a business, the group deploys payloads that install ransomware onto these endpoints.<\/p>\n\n\n\n
The ransomware will encrypt documents and bar company access. Check Point warned that INC Ransom will also use automation to rapidly take over enterprise-scale data systems.<\/p>\n\n\n\n
It noted that the group tends to target larger, multinational companies in high-value data industries, including the financial, healthcare, and technology sectors.<\/p>\n\n\n\n
INC Ransom rarely targets companies like Netstar, as most of its victims are enterprises in North America, Europe, and, to a lesser extent, Australia.<\/p>\n\n\n\n
Professional services, manufacturing, construction, and healthcare are its leading industries in terms of the number of victims.<\/p>\n\n\n\n
South Africa under attack<\/h2>\n\n\n\n![\"\"](\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2025\/08\/INC-Ransom-Netstar-data-breach-1200x685.jpg\")
<\/figure>\n\n\n\nAltron Netstar is not the only South African company to suffer a data breach this year. Attackers have targeted companies and government agencies across various sectors in the past eight months.<\/p>\n\n\n\n
In May, cyber extortion gang Everest Group claimed responsibility for an attack on Mediclinic<\/a>, stating that they exfiltrated 4GB of data and the personal data of 1,000 employees.<\/p>\n\n\n\nThat same week, Adidas South Africa notified customers that it suffered a data breach<\/a> with people\u2019s names, email addresses, phone numbers, genders, and birth dates potentially exposed.<\/p>\n\n\n\nIn the telecommunications sector, MTN<\/a> and Cell C<\/a> reported data breaches earlier this year, with Cell C confirming that it was the victim of a ransomware attack by a group called RansomHouse.<\/p>\n\n\n\nWhile Cell C was up-front and provided details about the attack it suffered, MTN was more tight-lipped, only saying that some people in certain markets were affected.<\/p>\n\n\n\n
Astral Foods<\/a>, South Africa\u2019s largest chicken producer, Eastplats<\/a>, a prominent mining company, and Pam Golding<\/a>, the largest real estate company in the country, all disclosed data breaches this year.<\/p>\n\n\n\nIn addition, Microsoft SharePoint became the target of a zero-day vulnerability in July, which caused headaches for organisations worldwide.<\/p>\n\n\n\n
SharePoint is a widely used web-based platform developed by Microsoft for collaboration and document management.<\/p>\n\n\n\n
The security flaw allowed attackers to access SharePoint servers and steal keys that let them impersonate users or services. This could enable deep access into compromised networks to steal confidential data.<\/p>\n\n\n\n
<\/figure>\n\n\n\nAltron Netstar is not the only South African company to suffer a data breach this year. Attackers have targeted companies and government agencies across various sectors in the past eight months.<\/p>\n\n\n\n
In May, cyber extortion gang Everest Group claimed responsibility for an attack on Mediclinic<\/a>, stating that they exfiltrated 4GB of data and the personal data of 1,000 employees.<\/p>\n\n\n\n That same week, Adidas South Africa notified customers that it suffered a data breach<\/a> with people\u2019s names, email addresses, phone numbers, genders, and birth dates potentially exposed.<\/p>\n\n\n\n In the telecommunications sector, MTN<\/a> and Cell C<\/a> reported data breaches earlier this year, with Cell C confirming that it was the victim of a ransomware attack by a group called RansomHouse.<\/p>\n\n\n\n While Cell C was up-front and provided details about the attack it suffered, MTN was more tight-lipped, only saying that some people in certain markets were affected.<\/p>\n\n\n\n Astral Foods<\/a>, South Africa\u2019s largest chicken producer, Eastplats<\/a>, a prominent mining company, and Pam Golding<\/a>, the largest real estate company in the country, all disclosed data breaches this year.<\/p>\n\n\n\n In addition, Microsoft SharePoint became the target of a zero-day vulnerability in July, which caused headaches for organisations worldwide.<\/p>\n\n\n\n SharePoint is a widely used web-based platform developed by Microsoft for collaboration and document management.<\/p>\n\n\n\n The security flaw allowed attackers to access SharePoint servers and steal keys that let them impersonate users or services. This could enable deep access into compromised networks to steal confidential data.<\/p>\n\n\n\n