El Salvador's Ministry of Local Development Hit by Rhysida Ransomware Attack
Incident Date:
April 23, 2024
Overview
Title
El Salvador's Ministry of Local Development Hit by Rhysida Ransomware Attack
Victim
Ministerio de Desarrollo Local
Attacker
Rhysida
Location
First Reported
April 23, 2024
Ransomware Attack on El Salvador's Ministry of Local Development by Rhysida Group
Overview of the Attack
The Rhysida Ransomware Group, a notorious cybercrime entity, has targeted the Ministerio de Desarrollo Local (MINDEL) of El Salvador. The attack involved the encryption of the ministry's website data, with a ransom demand of 8 BTC (approximately $530,000). The extent of data exfiltration is not fully disclosed, but leaked samples include miscellaneous documents.
Victim Profile: Ministerio de Desarrollo Local
MINDEL, established in 2019, is a decentralized government institution focused on improving the quality of life for those in vulnerable conditions in El Salvador. The ministry is pivotal in planning, controlling, and modernizing aspects related to state procurement. It is headquartered in San Salvador and led by Minister María Ofelia Navarrete de Dubón.
Targeting and Vulnerabilities
The choice of MINDEL as a target by Rhysida can be attributed to several factors:
- High Impact: As a government entity, MINDEL holds sensitive data and is critical to the administration of local development policies and programs, making it a high-value target.
- Vulnerabilities in Cybersecurity Measures: Like many government institutions, MINDEL may face challenges in maintaining robust cybersecurity defenses, possibly due to limited resources or rapid digital transformation.
- Visibility: Attacks on government sites are highly visible and can create significant pressure to pay ransoms, as they affect public services and trust.
Details of the Ransomware Employed
Rhysida ransomware, written in C++, targets Windows operating systems and encrypts files using the ChaCha20 encryption algorithm. The ransom notes are generated as PDF documents named “CriticalBreachDetected.pdf”. The group employs a double extortion technique, threatening to publish stolen data unless the ransom is paid.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.