funksec ransomware group lists mindev.gov.gr on its leak site

• Ransomware group: funksec
• Country: Greece
• Sector: Government & Defense
• Announcement date: January 9, 2025

Greek government institution listed on funksec leak site

The website mindev.gov.gr, which belongs to the Greek Ministry of Development and Investments, has been listed on a leak site by the ransomware group known as funksec. The threat actor has announced the breach and issued a specific ransom demand following the alleged compromise of the institution's digital infrastructure.

Details of the funksec claim

The threat actor known as funksec has officially listed the domain mindev.gov.gr on its leak site and issued a ransom demand. According to the group's announcement, they are demanding a payment of 50,000 USD. The group has set a deadline for this payment, stating that if the amount is not paid by January 20, 2025, they will proceed to publish the data they claim to have obtained.

In addition to the threat of publication, the group has issued a secondary ultimatum regarding communication. The group asserts that if the institution does not make contact within four days, they reserve the right to sell the stolen data to other interested parties. This tactic is a common characteristic of modern ransomware operations, often referred to as double extortion, where attackers threaten both the release of sensitive information and its sale on the dark web to maximize pressure on the victim.

Alleged data and evidence

Regarding the content of the breach, the group has provided certain visual evidence to support their claims. The available screenshots display images that are claimed to represent the institution's official documents and file directories. However, there is no detailed breakdown provided by the attackers regarding the full scope and content of the leaked data. The listing does not specify the exact types of files or the volume of information that has been compromised.

• No specific data types were listed in the announcement.

The Greek Ministry of Development and Investments

The target of this alleged attack is the Ministry of Development of Greece. This government body is responsible for managing the country's economic growth, investment, trade, and industrial policies. The ministry is tasked with the critical role of enhancing competitiveness and promoting sustainable development within the nation.

Analysis and potential impact

This incident suggests that sensitive data belonging to a government institution may have been compromised. The potential publication or sale of such data could have negative impacts on public security and government operations. Because the institution is located in an EU member state, the situation may lead to data protection violations under the General Data Protection Regulation (GDPR).

Furthermore, there are claims that the funksec group utilizes AI-powered tools, which may increase the complexity of such attacks and pose secondary risks to the institution's digital infrastructure. When government entities are targeted, the implications often extend beyond simple data theft, potentially affecting national administrative functions and public trust.

In response to such incidents, it is often necessary for the affected institution to initiate a comprehensive forensic investigation to determine the exact source and method of the breach. For organizations in the government and defense sector, maintaining robust security postures is essential to mitigate the risks posed by evolving threat actors. General defensive steps for organizations facing such threats include implementing strict access controls, maintaining offline backups, and conducting regular vulnerability assessments to identify weaknesses before they can be exploited by malicious actors.