Bangladesh Police targeted by Mogilevich ransomware group

• Ransomware group: Mogilevich
• Country: Bangladesh
• Sector: Government & Defense
• Announcement date: February 28, 2024

Mogilevich claims breach of Bangladesh Police data

The threat actor known as Mogilevich has announced a significant data breach involving the Bangladesh Police. According to a listing on a ransomware leak site, the group claims to have compromised approximately 13 GB of data belonging to the national law enforcement agency. The announcement was made on February 28, 2024, with the group claiming the attack occurred on the same day.

The threat actor has indicated that the stolen information is currently being offered for sale on the dark web. The group has set a deadline of February 3, 2024, for the transaction. Information regarding the specific identity, motivations, or technical capabilities of the Mogilevich group remains limited in the public domain, making it difficult to ascertain the full scope of their operations.

Details of the alleged data theft

The details provided by the threat actor suggest that the breach involves sensitive internal documentation. While the group has not provided any screenshots or visual evidence to verify the authenticity of the stolen files, they claim the cache consists of numerous internal infrastructure files. No specific file counts or ransom demands have been disclosed in the public announcement.

The listing identifies the following as the affected data:

• Internal infrastructure files

The lack of specific file types or a verified sample makes it difficult to determine the exact nature of the information contained within the 13 GB of data, though the focus appears to be on the organization's internal systems.

About the Bangladesh Police

The Bangladesh Police serves as the national law enforcement agency for Bangladesh. As the primary security institution for the nation, it is responsible for maintaining public order and is tasked with the prevention and investigation of crimes throughout the entire country.

Security implications and organizational risks

The alleged compromise of data belonging to a government agency carries significant implications for the security of state infrastructure. When a primary law enforcement agency is targeted, the breach of internal infrastructure files can pose substantial risks to the integrity of national security operations. Such incidents often involve double extortion tactics, where threat actors not only encrypt systems to disrupt operations but also threaten to leak or sell sensitive data to increase the pressure on the victim organization.

Beyond the immediate impact on the institution's operational continuity and data privacy, secondary risks are a major concern. The exposure of internal files can lead to targeted phishing attacks against employees and related units, as attackers may use the stolen information to craft highly convincing social engineering campaigns. Furthermore, there is an increased risk of identity theft if personal or sensitive administrative information is included in the breach. The sale of such data on the open market increases the likelihood that malicious actors will exploit the information for further criminal activities.

For organizations operating within the government and defense sectors, maintaining robust cybersecurity postures is essential to mitigate these risks. Common defensive strategies include the implementation of strict access controls, regular auditing of internal infrastructure, and comprehensive employee training to recognize social engineering attempts. Protecting the continuity of operations requires a multi-layered approach to security that prioritizes the protection of sensitive data and the hardening of critical infrastructure against unauthorized access.