Hackers Issue 10-Day Ultimatum to Mexican Government

A cyber attack of significant scale has been carried out in Mexico by the hacker group Ransomhub, as reported by CyberNews. The official website of the Mexican federal government, “GOB.MX”, was targeted in this attack, resulting in the theft of 313 GB of data. The hackers made their intentions clear by posting a message on their “dark” resource on November 15th.

The stolen information reportedly includes contracts, insurance documents, financial reporting, and other confidential files. The attackers have demanded a ransom from the government within ten days, threatening to release all the stolen materials if their demands are not met.

Ransomhub has also published more than 50 samples of files allegedly taken from the federal employees’ database on their website. These samples contain details such as full names of employees, positions, email addresses, photographs, and internal identification numbers.

Among the documents leaked are signed papers from 2023, including correspondence addressed to the IT director and communications officer of Mexico, Mario Gavina Morales, as well as a contract for transport services valued at around $100,000.

Ransomhub, a relatively new group that emerged in February 2024, has quickly risen to become one of the top three most active extortion groups this year, according to researchers from Searchlight Cyber. The group has targeted over 210 organizations since its inception, including major companies like Kawasaki Motors and Halliburton, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA).

Ransomhub employs the “Extortion as a Service” model (RAAS) and utilizes double extortion tactics, involving the theft of data with the threat of public disclosure. It is known that Ransomhub has previously operated as a front for the larger group BlackCat (Alphv).

This incident highlights the increasing vulnerability of even the most secure systems to emerging cybercriminals. These new players in the cybercrime world have quickly gained momentum and are now capable of targeting government structures of entire nations.

/Reports, release notes, official announcements.