Mogilevich claims to have breached Ireland's Department of Foreign Affairs

• Ransomware group: Mogilevich
• Country: Ireland
• Sector: Government & Defense
• Announcement date: February 27, 2024

Mogilevich claims a breach of Ireland's Department of Foreign Affairs

The threat actor group known as Mogilevich has claimed to have breached the systems of Ireland's Department of Foreign Affairs. According to an announcement made on a leak site, the group alleges they have successfully exfiltrated a significant amount of data from the institution's network.

Details of the alleged attack

The Mogilevich group announced their involvement in a post dated February 27, 2024. In this announcement, the threat actor claims to have obtained 7 GB of data from the institution's network. Following the alleged theft, the group has reportedly put this data up for sale on their platform. The announcement included a specific deadline of March 3, 2024, regarding the alleged data compromise.

While the group claims the stolen information consists of documents, the specific nature and content of the data remain unverified, as no screenshots were provided in the announcement to substantiate the claims.

Affected data types

• Corporate documents

The Department of Foreign Affairs

The Department of Foreign Affairs is the Irish government department responsible for managing Ireland's foreign policy, conducting international relations, and providing consular services to Irish citizens abroad.

Potential risks and implications

This incident may pose a risk of exposing sensitive foreign affairs data held by the institution. The alleged breach could lead to secondary risks such as identity theft or targeted phishing attacks against employees and associated third parties. Under the GDPR regulations applicable to Ireland, such a data breach may result in legal and administrative consequences.

Public information regarding the Mogilevich group is limited, and their methods and motivations remain uncertain. Potential negative impacts on the institution's operational security and the confidentiality of diplomatic correspondence may be observed.

In the broader context of modern cyber threats, ransomware groups often utilize a method known as double extortion. In these scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to leak the stolen information on public leak sites, attackers increase the pressure on organizations to pay a ransom to prevent the exposure of confidential records.

For organizations within the government and defense sectors, maintaining robust cybersecurity postures is essential to protect diplomatic correspondence and sensitive state data. Common defensive steps for organizations facing such threats include implementing strict access controls, maintaining comprehensive logging to detect unauthorized network movement, and ensuring regular, offline backups of critical data. Furthermore, continuous monitoring and employee awareness training regarding phishing attempts are vital components of a modern defense-in-depth strategy designed to mitigate the impact of potential data exfiltration.