Funksec ransomware group lists itc.gov.ae with 1K ! on its leak site

• Ransomware group: Funksec
• Country: United Arab Emirates
• Sector: Government & Defense
• Announcement date: December 24, 2024

The threat actor known as Funksec has listed access to an administrative panel, which they allege belongs to the itc.gov.ae domain, on their leak site. This announcement, posted on December 24, 2024, involves a claim of unauthorized access to a government entity's infrastructure in the United Arab Emirates.

Details of the Funksec claim

According to the announcement made by the Funksec group, the threat actor has listed access to an administrative panel belonging to the itc.gov.ae domain for sale. The group is demanding a ransom of 1,000 USD, specifically requesting payment in Bitcoin to facilitate the transaction. The listing includes a sense of urgency, as the group specifies that the access will remain available for sale for only a duration of two days, urging potential buyers to complete the transaction quickly.

Ransomware leak sites are frequently used by cybercriminal groups to exert pressure on organizations. In many modern extortion scenarios, actors employ double extortion tactics, where they not only encrypt a victim's systems but also threaten to leak sensitive data to public platforms if the ransom is not met. This method increases the leverage held by the attacker, as the threat of public exposure can cause significant reputational and regulatory damage to the target organization.

Data and information involved

The screenshots provided by the group as evidence of their access display an administrative panel interface. This interface appears to contain sensitive information related to Lycee Louis Massignon. The data types identified in the leaked screenshots include:

• Student names
• Student ID numbers
• Gender information
• School enrollment status

The exposure of such specific datasets, particularly those involving educational institutions and student records, highlights the sensitive nature of the information being targeted. When personal identifiers such as names and ID numbers are compromised, it can create long-term risks for the individuals involved.

Organization profile

The target of this alleged breach is the Integrated Transport Centre (ITC). The ITC is the official government entity responsible for regulating and overseeing the transport sector in the Emirate of Abu Dhabi. Its responsibilities include the management of public transport, the oversight of traffic systems, and the general development of transport infrastructure within the region.

Security implications and organizational defense

This incident suggests that systems belonging to government entities may be at risk of unauthorized access. The access information offered for sale could create vulnerabilities in the institution's network security and potentially facilitate secondary attacks. Furthermore, the exposure of student data may lead to risks such as identity theft and targeted phishing attacks for the affected individuals.

The claims made by the Funksec group regarding the use of AI-supported tools could indicate that their attacks may be conducted in a more sophisticated manner. As threat actors integrate artificial intelligence into their workflows, the complexity of detecting and defending against these attacks may increase.

For organizations operating within the government and defense sectors, maintaining robust access controls is critical. Implementing multi-factor authentication (MFA), adhering to the principle of least privilege, and conducting regular audits of administrative panels can help mitigate the risk of unauthorized access. Additionally, it is advisable for institutions to conduct necessary investigations within the framework of their national data protection regulations and to continuously review their access security protocols to defend against evolving threats.