LockBit Ransomware Hits Mexican Security Firm CUSAEM, Threatens Data Leak
Incident Date:
August 22, 2024
Overview
Title
LockBit Ransomware Hits Mexican Security Firm CUSAEM, Threatens Data Leak
Victim
CUSAEM (Cuerpo de Vigilancia Auxiliar y Urbana del Estado de México)
Attacker
Lockbit3
Location
First Reported
August 22, 2024
LockBit Ransomware Attack on CUSAEM
The ransomware group LockBit has claimed responsibility for a cyberattack on CUSAEM (Cuerpo de Vigilancia Auxiliar y Urbana del Estado de México), a security organization operating under the State of Mexico government. The attack was announced on LockBit's dark web leak site, where the group threatened to release 630 gigabytes of sensitive data unless a ransom is paid by August 30, 2023.
About CUSAEM
CUSAEM is a significant player in Mexico's private security landscape, providing auxiliary security services such as protection, custody, and surveillance for various public and private entities. Founded in 1946 and headquartered in Tlalnepantla de Baz, Estado de México, the organization employs between 501 and 1,000 individuals. CUSAEM's operations are funded through government allocations, and it has been involved in securing critical infrastructure, including banks, government agencies, highways, and nuclear facilities.
Vulnerabilities and Criticisms
CUSAEM has faced criticism for its lack of transparency and accountability. The National Human Rights Commission (CNDH) has highlighted issues related to the conduct of its personnel and the opacity surrounding its operations. The organization's semi-autonomous nature and financial management have also drawn scrutiny, making it a vulnerable target for cyberattacks.
Details of the Attack
The LockBit ransomware group has seized 630 gigabytes of sensitive data from CUSAEM. The attackers have threatened to publish this data unless a ransom is paid. This incident underscores the vulnerabilities within CUSAEM, particularly its cybersecurity measures and the need for greater accountability.
About LockBit
LockBit is a highly sophisticated ransomware-as-a-service (RaaS) group that has been active since September 2019. Known for its "double extortion" tactics, LockBit exfiltrates sensitive data and threatens to release it publicly if the ransom is not paid. The group uses a combination of RSA-2048 and AES-256 encryption algorithms to encrypt victims' files. LockBit typically exploits vulnerabilities in Remote Desktop Protocol (RDP) services and unsecured network shares to spread quickly across a network.
Penetration Methods
LockBit likely penetrated CUSAEM's systems by exploiting vulnerabilities in RDP services and unsecured network shares. The ransomware's modular design and encryption techniques make it difficult to detect and analyze, allowing it to spread rapidly within the targeted network.
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.