Barilga.gov.mn listed on funksec ransomware leak site

• Ransomware group: funksec
• Country: Mongolia
• Sector: Government & Defense
• Announcement date: January 15, 2025

Funksec claims breach of Mongolian government portal

The domain barilga.gov.mn, which serves as the official portal for the Construction Development Center of Mongolia, has been listed on a ransomware leak site by the threat actor group known as funksec. This announcement, made on January 15, 2025, marks a significant claim of unauthorized access to a critical government infrastructure in Mongolia.

The incident follows a pattern common in modern cyber extortion, often referred to as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to publish or sell stolen information on public leak sites, attackers increase the pressure on the victim to meet their financial demands.

Details of the ransom demand and claims

According to the announcement posted by funksec, the group claims to have successfully accessed the institution's internal data. The group has issued a ransom demand of 1 million USD. The attackers have explicitly stated that if this ransom is not paid, the stolen data will be offered for sale on the dark web.

The timing of the announcement coincides with the claimed date of the attack, which was also January 15, 2025. While the group has asserted its ability to access the network, the organization has not issued a public statement regarding the breach or the validity of the claims at this time.

Scope of the alleged data exfiltration

The funksec group claims to have obtained a wide variety of sensitive information spanning a significant timeframe. The leaked data is said to cover the period from 2014 to 2025. According to the group's claims, the stolen files include various types of sensitive documentation that could impact the operational integrity of the institution.

The specific types of data the group claims to have stolen include:

• Employee information
• Payment plans
• Secret reports

The inclusion of such a broad range of data, particularly spanning over a decade, suggests a potential long-term presence within the network or a very comprehensive extraction of historical archives. The presence of secret documents and Excel files indicates that the attackers may have targeted administrative and financial records.

The target organization

Barilga.gov.mn is an official government portal in Mongolia that manages regulations, standards, and public policies related to the construction sector. It serves as a central information hub for construction projects, licensing, and industry data.

Risk assessment and defensive considerations

This leak claim carries a high level of severity due to the potential for sensitive government data to become public. Because the institution is a part of the government, the exposure of its operational data and employee information could be utilized by malicious actors for secondary attacks. Such data is often used in highly targeted phishing campaigns, where attackers use specific, legitimate-sounding details to deceive employees or citizens.

Furthermore, there are claims that the funksec group utilizes AI-supported tools, which suggests that the methods used to conduct these attacks may be increasingly sophisticated. The use of artificial intelligence in cyberattacks can allow threat actors to automate certain stages of an intrusion or to craft more convincing social engineering lures.

For organizations within the government and defense sectors, such incidents highlight the importance of robust cybersecurity frameworks. Defensive strategies typically include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular network segmentation to prevent lateral movement. Additionally, organizations often rely on continuous monitoring and advanced threat detection to identify unauthorized access before data exfiltration can occur. Protecting sensitive government data remains a critical priority to prevent the downstream risks associated with identity theft and the exposure of state-managed industry regulations.