Funksec ransomware group lists mts.gov.eg on its leak site

• Ransomware group: Funksec
• Country: Egypt
• Sector: Government & Defense
• Announcement date: January 15, 2025

Funksec claims a data breach against Misr Technology Services

The threat actor group known as Funksec has made a data leak claim against the Egyptian government domain mts.gov.eg. According to an announcement made on a leak site on January 15, 2025, the group claims to have exfiltrated sensitive information belonging to the organization.

Details of the alleged attack

The Funksec group listed the mts.gov.eg domain on their leak site on January 15, 2025, claiming to have exfiltrated sensitive data. The threat actor demands a ransom of 1 million USD and states that if the ransom is not paid, the data will be offered for sale for 50,000 USD. This approach, where a group threatens to leak or sell stolen information if a ransom is not met, is a hallmark of double extortion tactics. In such scenarios, attackers aim to maximize pressure by threatening the confidentiality of the data in addition to the unavailability of systems.

The Funksec group is a relatively new entity in the cyber threat landscape, having emerged in late 2024. The group is known for claiming to utilize AI-powered tools to assist in their various operations. The timing of the claim suggests a rapid operational cycle for this emerging group.

Alleged data involved in the breach

The group claims to have obtained a variety of sensitive documents and spreadsheets. The alleged data includes secret reports, payment plans, employee information, ship movements, ship types, route plans, coordinates, and ship names. The potential impact of such a leak involves several critical categories of information:

• Employee information
• Financial data
• Logistics data

About Misr Technology Services (MTS)

Misr Technology Services (MTS) is a government entity operating under the Egyptian Ministry of Finance. The organization is responsible for the digitalization of the country's customs processes. It manages a single-window electronic platform designed to modernize logistics and customs operations within the country.

Analysis and potential impact

This alleged breach may pose risks to the institution's operational security and the confidentiality of its logistics data. The potential public disclosure of the claimed data could lead to targeted phishing attacks against employees and the misuse of sensitive information such as shipping routes. Furthermore, the institution may face legal obligations under Egyptian data protection regulations due to the nature of the sensitive information involved.

The activities of the Funksec group should be monitored closely regarding both corporate network security and supply chain integrity. When organizations in the government and logistics sectors face such threats, it highlights the importance of robust defensive measures. Common defensive steps for organizations include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training to mitigate the risk of phishing. Additionally, monitoring for unauthorized data exfiltration and maintaining offline, immutable backups are essential components of a modern cybersecurity posture to defend against ransomware and double extortion tactics.