Funksec ransomware group lists ndc.energy.mn on its leak site

• Ransomware group: Funksec
• Country: Mongolia
• Sector: Energy & Utilities
• Announcement date: December 20, 2024

Funksec claims to have compromised National Dispatch Center data

The National Dispatch Center (NDC) of Mongolia has been listed by the threat actor known as Funksec following an alleged data breach. The group has published a ransom notice on their leak site, claiming to have successfully compromised sensitive information belonging to the organization. This incident highlights the ongoing targeting of critical infrastructure by modern ransomware groups.

According to the announcement made on December 20, 2024, the Funksec group alleges that they have obtained a MySQL database dump. The group claims the size of this stolen data is 1.3 GB. In their ransom notice, the attackers have set a deadline of January 1, 2025, for the payment of a 10,000 USD ransom demand. This type of extortion is a hallmark of modern ransomware operations, where attackers use the threat of leaking sensitive information to pressure organizations into paying.

Details of the alleged data theft

The information released by the threat actor suggests a significant breach of organizational data. The group claims the stolen content consists of a MySQL database dump. Based on the details provided in the announcement, the following types of data are reportedly included in the breach:

• Energy tariffs
• Meter readings
• User information
• Network device logs
• Organizational data

The presence of such diverse data types, ranging from technical logs to consumer-related information, indicates a broad compromise of the target's digital environment.

About the National Dispatch Center

The National Dispatch Center (NDC) is a vital state-owned entity in Mongolia. It is responsible for the operational management of the country's power grid and the control of the energy transmission system. The organization is tasked with ensuring the security of the nation's energy supply and coordinating the electricity transmission network, making it a critical component of Mongolia's national infrastructure.

Analysis and potential impact of the breach

This alleged breach may pose operational risks to Mongolia's energy infrastructure. The data, which reportedly includes meter and network device information, could potentially be utilized for secondary attacks or targeted phishing campaigns against critical infrastructure. The Funksec group, which emerged in late 2024, is reported to utilize AI-powered tools, adding a layer of sophistication to their operations.

The incident involves what appears to be double-extortion tactics. In these scenarios, threat actors not only encrypt an organization's systems but also steal sensitive data to threaten its public release. This approach increases the pressure on the victim, as the potential publication or sale of the data could lead to significant reputational damage and operational disruptions. Furthermore, the organization may face regulatory scrutiny under local data protection laws due to this incident.

In the broader context of cybersecurity, ransomware leak sites serve as a platform for attackers to shame their victims and demand payment. When organizations in the energy and utilities sector are targeted, the stakes are significantly higher due to the potential for physical-world consequences. To defend against such threats, organizations typically implement multi-layered security strategies. This includes robust backup solutions that are stored offline to prevent encryption, strict network segmentation to contain breaches, and continuous monitoring of network traffic to detect unauthorized access. Additionally, implementing strong identity and access management (IAM) and conducting regular security awareness training can help mitigate the risk of initial access through phishing or credential theft.