Jordanian aviation regulator carc.gov.jo targeted by funksec ransomware group

• Ransomware group: funksec
• Country: Jordan
• Sector: Government & Defense
• Announcement date: January 9, 2025

Funksec group claims data breach against Jordan's aviation regulator

The Civil Aviation Regulatory Commission (CARC) of Jordan has been listed on the leak site of the ransomware group known as funksec. The threat actor group has claimed a significant data breach involving the carc.gov.jo domain, alleging that they have successfully compromised sensitive information belonging to the Jordanian government entity.

According to the announcement made on January 9, 2025, the funksec group claims to have stolen approximately 1 GB of data. The group has set a ransom demand of 1,000,000 USD to prevent the release of the information. Additionally, the group has specified a price of 20,000 USD for the sale of the data itself.

Details of the alleged data theft

The claims made by the funksec group suggest that the stolen information is highly sensitive and contains strategic documentation. The group alleges that the compromised data consists of 1 GB of secret PDFs, various documents, full plans, and specific cybersecurity plans. This type of double extortion tactic, where attackers both encrypt systems and threaten to leak sensitive data, is a common method used by modern ransomware groups to increase pressure on their victims.

The specific types of data allegedly compromised include:

• Secret documents
• Cybersecurity plans
• Aviation plans

While the group has provided details regarding the volume and nature of the files, they have not provided a specific file count for the stolen data.

About the Civil Aviation Regulatory Commission

The Civil Aviation Regulatory Commission (CARC) of Jordan is the official government body responsible for regulating, supervising, and ensuring the safety of civil aviation activities in Jordan. It is responsible for the management of the country's airspace and the implementation of aviation standards. As a critical government entity, the organization plays a vital role in maintaining the safety and regulatory compliance of the nation's aviation sector.

Implications and security considerations

This incident suggests that cyberattacks against government entities may pose risks to operational continuity and national security. The alleged compromise of cybersecurity plans could potentially increase the risk of secondary attacks against the institution's defense mechanisms, as attackers may gain insight into how the organization protects its infrastructure. Furthermore, reports that the funksec group utilizes AI-assisted tools indicate that these attacks may be increasingly sophisticated and targeted.

The potential public release or sale of the institution's data could create negative implications for aviation sector standards and regulatory compliance. For organizations operating within the government and defense sectors, such incidents highlight the necessity of robust defensive measures. Common defensive steps for organizations facing these threats include implementing strict access controls, maintaining offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by sophisticated actors.

The evolution of ransomware tactics

The use of AI-assisted tools by groups like funksec represents a growing trend in the cyber threat landscape. As attackers integrate advanced technologies into their workflows, the complexity and speed of targeted attacks against critical infrastructure and government bodies are expected to rise. This evolution places a higher burden on national security agencies to maintain resilient and adaptive cybersecurity postures to protect essential services and sensitive state information.