nanoCAD Listed by Malas Ransomware Group

On April 09, 2023, nanoCAD was listed on the leak site operated by the malas ransomware group. The company, whose software is used by engineers, architects, and individual designers worldwide, confirmed that attackers had exfiltrated internal files during a ransomware incident that leveraged a Zimbra vulnerability. The leak-site posting does not specify the number of records affected or detail exactly which files were taken.

Primary Disclosure Details

The malas leak site entry states that nanoCAD suffered a ransomware attack in which internal files were exfiltrated. It explicitly attributes initial access to a Zimbra collaboration-suite vulnerability. No victim count is provided, and the listing does not enumerate the precise data types beyond “internal files.” The disclosure indicates the data is now available for download to anyone who visits the onion address, a common extortion tactic designed to pressure the victim into payment. Public reporting on similar listings confirms that once data appears on these sites, it is effectively public and can be freely copied by other threat actors.

Why This Matters for You and Your Family

If you or anyone in your household has used nanoCAD, worked with a firm that relies on it, or had business dealings with the company, your information may now sit in an easily searchable archive. Internal files frequently contain contracts, employee directories, customer lists, invoices, and correspondence that include names, addresses, email addresses, phone numbers, and sometimes Social Security numbers or tax identifiers. Even when the leak-site listing does not quantify affected records, the real-world exposure is immediate: once exfiltrated data leaves the victim’s control, it circulates on multiple underground forums within days. For ordinary people, this translates into higher risks of identity theft, phishing campaigns tailored with genuine business context, and unwanted solicitations that feel personal because the attackers possess accurate details about your dealings with nanoCAD.

Doxxing and Identity-Chain Implications

Files taken in ransomware attacks like this rarely contain only one type of information. A single spreadsheet can link your work email to your personal phone number, home address, and even details about family members listed as emergency contacts. Threat actors routinely combine these fragments with data from previous breaches to build complete identity profiles. The result is an identity chain that stretches far beyond the original nanoCAD relationship. Criminals use these chains to hijack online accounts, file fraudulent tax returns, or impersonate you in financial transactions. When children’s names or school-related documents appear in the same dataset, the exposure can follow them into adolescence through gaming usernames or social-media handles that share the same family address or parent email.

malas Ransomware Group Track Record

Public reporting attributes the malas ransomware group with emerging in late 2022. The group has targeted organizations across manufacturing, technology, and professional-services sectors, often gaining initial access through unpatched vulnerabilities in email and collaboration platforms such as Zimbra. Notable prior victims include mid-sized engineering firms and software developers whose internal project files were later posted when ransom demands went unpaid. Their typical playbook involves exploiting a single remote-access flaw, exfiltrating documents before encryption, and then publishing samples on their leak site with countdown timers. The group does not always encrypt systems; in many cases the mere threat of releasing sensitive internal files is sufficient to trigger payment pressure. This pattern matches the nanoCAD listing, where the emphasis rests on the exfiltrated data rather than any encrypted network.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you ever used at nanoCAD or associated business accounts anywhere it has been reused, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same family address or parent credentials exposed in incidents like this.
• Let DoxxScan remediation specialists manage takedown requests for any personal information already circulating on data-broker and underground sites.

The nanoCAD breach is a clear reminder that even specialized design software can become the gateway to broad personal exposure when corporate security gaps exist. Acting quickly on the credentials and contact details now in circulation can limit how far attackers carry the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to credential-stuffing attacks that follow leaks of this nature.