Cyber Incident Victim: Volaris
Date:
Mar 2023
Location:
Mexico
Summary
The Mexican airline Volaris was listed on the Cl0p ransomware gang's leak site following a cyberattack exploiting a zero-day vulnerability in Fortra's GoAnywhere managed file transfer solution. The incident resulted in unauthorized access and data exposure, part of a broader campaign where the gang compromised numerous organizations. Cl0p's attacks typically involve extortion by threatening to leak stolen data, though specific impacts on the airline's operations or customer data were not detailed in available reports.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 23, 2023, the Cl0p ransomware gang listed Mexican airline Volaris among approximately 30 new victims added to their dark web leak site during a coordinated spree. This occurred alongside high-profile entities including Toronto Municipality, US-based Gray Television, and Virgin Group’s rewards program Virgin Red. The gang’s leak site typically publishes victim names alongside unverified claims about stolen data and corporate revenues to pressure organizations into paying ransoms. Cl0p’s resurgence followed a brief operational pause after law enforcement arrested several affiliates in late 2021, with the group reactivating its extortion campaign earlier in March 2023. No specific details regarding the scope of Volaris’s incident—such as data types compromised, operational disruptions, or ransom demands—were disclosed in available reports.
The broader Cl0p campaign exploited a zero-day vulnerability in Fortra’s GoAnywhere managed file transfer (MFT) software, which multiple confirmed victims—including Virgin Red—identified as the intrusion vector. Attackers exfiltrated files from organizations using vulnerable GoAnywhere instances, though Virgin Red clarified that no customer or employee personal data was exposed in their case. Cl0p historically ties ransom demands to victim revenue estimates, as seen with their $18 billion revenue claim against Virgin Group, though such figures often lack verification. The gang’s March 23 victim list expanded a global targeting pattern spanning aviation, education, energy, and municipal sectors, with prior victims including Shell, Stanford University, and Bombardier. Cl0p’s operations have reportedly accumulated approximately $500 million in ransom payments by November 2021, underscoring the group’s persistent threat profile despite intermittent law enforcement disruptions.