Carding 4 Carders
Professional
What is known about the mysterious group that continues to attack governments around the world?
The Rhysida ransomware group has launched a series of attacks on government agencies in Portugal and the Dominican Republic.
It all started on Wednesday, September 27. The first victim was the city of Gondomar, located just 20 minutes from Porto, Portugal. The city authorities were forced to disable all official online services, asking for help from the National Cybersecurity Center and the National Data Protection Commission. During the week, residents were forced to apply to state institutions in person. At the same time, the organizations themselves continued to work as usual, despite technical difficulties.
By the end of the week, electronic systems were still not functioning, including email. The Mayor's office does not answer questions about when the platforms will be fully restored.
The day after the attack on Gondomar, cybersecurity expert Dominic Alvieri said that Rhysida claimed responsibility for the incident. Moreover, the group published on its website examples of passports and financial documents allegedly stolen from the municipality.
Gondomar wasn't the hackers ' only target. The Migration Agency of the Dominican Republic also confirmed the cyberattack. Hackers stole confidential files with names, addresses and dates of birth of citizens. It is worth noting that the agency's systems were not encrypted.
On the leak site, Rhysida states that the data will be put up for sale if the ransom is not paid. They also indicated the preliminary cost of materials — 25 BTC (approximately $700,000). Representatives of the agency said that they first recorded suspicious activity on September 14, after which they notified the country's National Cybersecurity Center.
Rhysida has previously attacked hospitals in the United States and Portugal, as well as governments in Kuwait, Chile and the Caribbean. Despite its activity, little is known about the group.
They recently made headlines in the United States due to a devastating attack on Prospect Medical Holdings, which is responsible for operating 16 hospitals in several states.
The Rhysida ransomware group has launched a series of attacks on government agencies in Portugal and the Dominican Republic.
It all started on Wednesday, September 27. The first victim was the city of Gondomar, located just 20 minutes from Porto, Portugal. The city authorities were forced to disable all official online services, asking for help from the National Cybersecurity Center and the National Data Protection Commission. During the week, residents were forced to apply to state institutions in person. At the same time, the organizations themselves continued to work as usual, despite technical difficulties.
By the end of the week, electronic systems were still not functioning, including email. The Mayor's office does not answer questions about when the platforms will be fully restored.
The day after the attack on Gondomar, cybersecurity expert Dominic Alvieri said that Rhysida claimed responsibility for the incident. Moreover, the group published on its website examples of passports and financial documents allegedly stolen from the municipality.
Gondomar wasn't the hackers ' only target. The Migration Agency of the Dominican Republic also confirmed the cyberattack. Hackers stole confidential files with names, addresses and dates of birth of citizens. It is worth noting that the agency's systems were not encrypted.
On the leak site, Rhysida states that the data will be put up for sale if the ransom is not paid. They also indicated the preliminary cost of materials — 25 BTC (approximately $700,000). Representatives of the agency said that they first recorded suspicious activity on September 14, after which they notified the country's National Cybersecurity Center.
Rhysida has previously attacked hospitals in the United States and Portugal, as well as governments in Kuwait, Chile and the Caribbean. Despite its activity, little is known about the group.
They recently made headlines in the United States due to a devastating attack on Prospect Medical Holdings, which is responsible for operating 16 hospitals in several states.
