Ransomware Hits Colombia Justice Ministry Before Transition

Colombia’s Ministry of Justice and Law was hit by a ransomware attack only days before the country’s presidential transition, according to Dark Reading. The incident disrupted the ministry’s IT environment and highlights continuing threats against government institutions and other critical organizations in Latin America.

The attackers encrypted systems, but the report did not identify the ransomware family, initial access vector, ransom demand or whether sensitive records were exfiltrated. Investigators are expected to examine compromised accounts, exposed remote-access services, malicious scripts and command-and-control activity to determine how the attackers entered the network.

The timing increases the risk of operational disruption as officials manage the transfer of authority. Incident responders will need to isolate affected systems, preserve forensic evidence, validate backups and determine whether stolen ministry data could be used for extortion or follow-on phishing campaigns.

Defenders reviewing externally exposed infrastructure can use a port scanner to identify vulnerable services and a WHOIS lookup to investigate domains linked to suspicious activity. Colombian agencies should also require phishing-resistant multi-factor authentication and verify that recovery systems are isolated from production networks.