Corantioquia Hit by MEOW Ransomware Group in Major Cyber Attack
Incident Date:
October 1, 2024
Overview
Title
Corantioquia Hit by MEOW Ransomware Group in Major Cyber Attack
Victim
Corantioquia
Attacker
Meow
Location
First Reported
October 1, 2024
Ransomware Attack on Corantioquia: A Closer Look at the MEOW Ransomware Group's Latest Target
Corantioquia, officially known as the Corporación Autónoma Regional del Centro de Antioquia, has recently fallen victim to a ransomware attack by the MEOW ransomware group. This public entity, headquartered in Medellín, Colombia, is tasked with managing and protecting the environment in the central region of Antioquia. With a workforce of 201 to 500 employees, Corantioquia plays a pivotal role in promoting sustainable development through environmental management and community engagement initiatives.
Corantioquia's Role and Vulnerabilities
Corantioquia stands out in its industry due to its legal and financial autonomy, allowing it to implement various environmental policies and initiatives. The organization focuses on biodiversity conservation, ecosystem management, and climate change adaptation, collaborating with local communities to ensure effective conservation strategies. However, its status as a public sector entity makes it a prime target for cyber threats, as these organizations often face challenges in maintaining effective cybersecurity measures.
Details of the Ransomware Attack
The MEOW ransomware group claims to have exfiltrated 230 GB of data from Corantioquia, highlighting the vulnerability of public sector entities to sophisticated cyber threats. This breach underscores the critical need for comprehensive data protection strategies and incident response plans. The attack has the potential to severely disrupt Corantioquia's operations, affecting its ability to manage and protect the environment effectively.
Understanding the MEOW Ransomware Group
Emerging in late 2022, the MEOW ransomware group is associated with the Conti v2 ransomware variant. Known for its aggressive tactics, the group frequently targets industries with sensitive data, such as healthcare and medical research. MEOW employs various infection methods, including phishing emails, exploit kits, and Remote Desktop Protocol vulnerabilities. Once a system is compromised, the ransomware encrypts files using a combination of the ChaCha20 and RSA-4096 algorithms.
Potential Penetration Methods
The MEOW ransomware group could have penetrated Corantioquia's systems through several vectors. Given the group's history, phishing emails and exploiting RDP vulnerabilities are likely methods. The attack highlights the importance of maintaining up-to-date security protocols and employee training to recognize and respond to potential threats.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.