corahperu.org listed on APT73 ransomware leak site

• Ransomware group: APT73
• Country: Peru
• Sector: Government & Defense
• Announcement date: April 27, 2026

The APT73 ransomware group has listed the website of Proyecto Especial CORAH, an entity affiliated with the Peruvian government, on its leak site. According to the announcement made on April 27, 2026, the group claims to have successfully targeted the organization, resulting in a significant data breach involving internal documentation and communications.

The claimed attack and event details

The ransomware group APT73 has published a notice on its dedicated leak site claiming responsibility for an attack against corahperu.org. The group alleges that it has gained unauthorized access to the institution's internal systems, allowing them to obtain various sensitive documents and internal correspondence. The incident is reported to have occurred on April 27, 2026, the same day the announcement was posted.

In the context of modern cybercrime, such incidents often follow the pattern of double extortion. In these scenarios, threat actors do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to release stolen data on public leak sites, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. While the specific ransom demand for this incident was not mentioned in the announcement, the presence of the organization on a leak site is a hallmark of this extortion tactic.

The data involved in the leak

The APT73 group claims that the breach involves a total of 10 GB of data. The leaked information is said to consist of internal documents and email data. According to the group's claims, screenshots provided as evidence show various types of sensitive material, including official correspondence and administrative documents. The specific types of data identified in the listing include:

• Internal documents
• Emails
• Official correspondence
• Vehicle distribution forms

The disclosure of such a volume of data, particularly when it includes internal communications and administrative forms, can significantly impact the operational integrity of the targeted entity. While the group has provided screenshots to support their claims, the full contents of the 10 GB dataset have not been made available through the summary provided by the group.

About the organization

The target of this alleged attack, corahperu.org, is the Proyecto Especial CORAH (Control de Cultivos de Coca en el Alto Huallaga). This organization is a special government project operating under the authority of the Peruvian Ministry of Interior. Its primary mission and responsibility involve the control and eradication of coca crops within its designated jurisdiction.

Implications and defensive considerations

This incident highlights the ongoing risks that cyberattacks against government institutions pose to public safety and operational confidentiality. The exposure of official correspondence can lead to the leakage of sensitive information regarding the institution's specific operations and strategic functions. Furthermore, such breaches can create secondary risks for the organization, including the potential for identity theft or the execution of highly targeted phishing attacks directed at employees and relevant stakeholders.

When government entities are targeted, the consequences often extend beyond digital disruption to include legal and regulatory implications. In this case, the institution may face legal responsibilities under the framework of Peru's data protection legislation. Organizations operating within the government and defense sector should prioritize robust defensive measures to mitigate these risks. This includes implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized movement, and conducting regular security awareness training to help staff recognize phishing attempts.

Additionally, maintaining regular, offline backups and ensuring a rapid incident response plan are critical components of a modern cybersecurity posture. As public information regarding the APT73 group remains limited, organizations are advised to remain vigilant against the tactics and techniques commonly employed by ransomware groups targeting state-level infrastructure.