Funksec claims data breach against qed.co.ug

• Ransomware group: Funksec
• Country: Uganda
• Sector: Technology
• Announcement date: January 27, 2025

Funksec lists qed.co.ug on leak site

The threat group known as Funksec has officially listed qed.co.ug, a technology firm based in Uganda, on its dedicated leak site. According to the announcement, the group claims to have successfully targeted the organization and obtained access to its internal systems. This development follows a pattern common in modern cyber extortion, where threat actors use public-facing leak sites to pressure victims by threatening to release sensitive information to the public if their demands are not met.

The listing, which appeared on January 27, 2025, marks a targeted action by the group against the Ugandan entity. While the presence of an organization on a leak site is a significant indicator of a potential security incident, it remains a claim made by the threat actor. Such incidents often involve double extortion tactics, where attackers not only encrypt systems to disrupt operations but also steal data to increase their leverage during negotiations.

Details of the alleged attack and ransom demand

The incident involving qed.co.ug was announced by Funksec on January 27, 2025, the same day the group claims the attack took place. The threat actor asserts that they have exfiltrated confidential data from the organization's systems through an unauthorized intrusion. This type of claim is a hallmark of ransomware operations, where the threat of data exposure is used as a primary tool for coercion.

In the announcement, the group has specified a financial requirement to prevent the release of the alleged stolen information. The ransom demand has been set at 1000 USD. In many ransomware scenarios, these demands can fluctuate based on the perceived value of the data or the size of the victim organization, though the specific details regarding the volume of data or the exact number of files involved in this particular case were not provided in the announcement.

Claimed exfiltrated data types

The threat actor has identified several categories of information that they claim to have stolen from the organization. The data mentioned in the leak site announcement includes:

• Reports
• Secret messages
• User information
• Contact details

The exposure of such information, if verified, can present significant challenges for an organization, particularly regarding the privacy of its users and the confidentiality of its internal communications.

About qed.co.ug

QED is a technology and software development company based in Uganda. The firm provides digital solutions and software services for various sectors, positioning itself as a provider of technical expertise and digital tools within the region.

Impact assessment and defensive considerations

The alleged leak of information could lead to several negative consequences for the organization. Primarily, such a breach can impact operational continuity and damage the trust that clients place in the firm. When sensitive data is compromised, the organization may face difficulties in maintaining its professional reputation and fulfilling its service obligations to its partners and customers.

Furthermore, the specific nature of the data claimed to be stolen—including contact details and user information—could facilitate secondary risks. Third parties may attempt to use this information to conduct targeted phishing attacks, leveraging the stolen details to appear legitimate to the victims. This secondary wave of attacks is a common byproduct of data breaches, where stolen identity and contact information are used to exploit the human element of an organization.

The Funksec group, which emerged in late 2024, has been noted for potentially utilizing AI-powered tools in their operations. This suggests that their attack methodologies may involve automated processes, which can increase the speed and scale of their activities. For organizations in the technology and software development sector, maintaining robust data protection protocols is essential. This includes implementing strong access controls, regular security audits, and comprehensive monitoring to detect unauthorized exfiltration. Additionally, notifying relevant stakeholders and implementing incident response plans are critical steps in mitigating the risks associated with such breaches.