The regime of Costa Rica alleged a land of emergency this calendar week after a massive ransomware attack locked down reckoner networks across multiple government agencies, paralyzing tax collection and leaving the individual information of Costa Rican citizens vulnerable.
According to the
emergency declaration, the crisis
on April 12 with a “strong cyberattack on the databases of the Costa Rican Ministry of Finance.”
The attack spread to the “databases of other institutions” from there, becoming a major threat to national security. The Costa Rican statement said the full extent of the assault was not yet known.
on Wednesday that a notorious and highly destructive international ransomware gang chosen Conti appears to be responsible for the attack, having published documents pilfered from Costa Rican government computers to its dark website on Lord’s day.
by Conti is about 672 gigabytes in size and purportedly includes data stolen from the Finance Ministry, Ministry of Labor and Social Security, Social Development and Family Allowances Fund, and Interuniversity Headquarters of Alajuela. The hackers said they published the data later on Costa Rica refused to pay $x 1000000 in ransom.
Conti’s members appear to be mostly Russian and Eastern European. The group pledged fidelity to the Russian state when the invasion of Ukraine began. Its previous crimes include a $xx million ransomware attack on the Health Service Executive of Ireland and a failed attempt to breach dozens of American healthcare systems.
A Ukrainian cybersecurity adept claimed in February to have hacked Conti itself,
exposing a trove of alleged chat messages and other correspondence between group members.
These messages indicated, if authentic, that Conti has ties to Russia’s FSB security service and its armed services hacking units, but seems to have an identity distinct from the Russian government — the grouping is willing and eager to piece of work on Russia’s behalf, and plainly believes Russian agents would help if they got into legal trouble, simply is not straight controlled past the Kremlin.
The Conti hacker who posted the data dump included a
, “no organized team was created for this set on, no government or other countries has finalized this attack, everything was carried out by me with a successful affiliate.”
“The purpose of this attack was to earn coin, in the time to come I will definitely carry out attacks of a more serious format with a larger squad, Costa Rica is a demo version,” the hacker said.
The state of emergency was declared by Costa Rican President Rodrigo Chaves, who was but sworn in on Sun.
“Nosotros’ve signed the decree so the state can defend against the criminal attack that cyber criminals are carrying out. This is an assault on the nation and we have signed this decree to help u.s. defend ourselves better,” Chaves said.
the Costa Rica attack, like most of Conti’s alleged contempo jobs, employed a “double-extortion” strategy of threatening to release stolen data if the ransom was non paid.
Classic ransomware attacks encrypt the information without stealing it, demanding a ransom from the victim to obtain the software keys needed to unlock their ain system. Ransomware has proven fearsomely lucrative because targeted corporate and government targets often conclude paying the ransom is cheaper, and much faster, than hiring experts to decrypt the information and free their captured systems.
Cyberdefense analyst Roger Grimes told ThreatPost that no matter what Conti chooses to dump on its dark web site, the grouping probably has “every employee’s personal login credentials to any Costa Rican government site that they visited during the fourth dimension the ransomware was active on the system earlier information technology locked files.”
“If Costa Rica was hosting customer-facing websites in the compromised domains, like they probable were, their customers’ credentials – which are ofttimes reused on other sites and services the customers visit – are probable compromised, too. Non paying the ransom puts not just Costa Rica’s own services at risk, but those of their employees and customers,” Grimes said.
Security engineer Silas Cutler of the Stairwell security firm described Republic of costa rica’s land of emergency as a pivotal moment, an “important rallying call to the balance of the world.”
“While the emergency status may have a limited directly bear upon… it puts the severity of this alienation into the same category as a natural disaster or armed services incident,” Cutler said.
The U.S. State Department last calendar week
a reward of up to $ten one thousand thousand for information leading to the identification and location of Conti grouping leaders, plus some other $five million for information leading to the arrest of “any individual in any country conspiring to participate in or attempting to participate in a Conti variant ransomware incident.”
The State Department cited the ransomware set on on Costa Rica equally a prime reason for offering the compensation under its Transnational Organized Crime Rewards Plan (TOCRP).
“In offering this reward, the Us demonstrates its delivery to protecting potential ransomware victims around the globe from exploitation by cyber criminals. Nosotros wait to partner with nations willing to bring justice for those victims affected by ransomware,” the State Department said.