Mol.go.th listed on Devman ransomware leak site

• Ransomware group: Devman
• Country: Thailand
• Sector: Government & Defense
• Announcement date: July 17, 2025

Devman claims attack on Thailand's Ministry of Labour

The domain mol.go.th, which is attributed to the Ministry of Labour of Thailand, has been listed on the leak site of the Devman ransomware group. This announcement, made on July 17, 2025, marks a significant claim of a cyberattack against a major government entity. The threat actor group, known as Devman, has published a leak announcement asserting that they have successfully compromised data belonging to the institution.

The group alleges that the breach occurred on July 17, 2025. According to the claim, the attackers have exfiltrated a significant amount of information and are now attempting to extort the organization. While the group has made these public claims, it is important to note that information regarding this specific group remains limited in the public domain.

Details of the alleged exfiltration and ransom demand

The Devman ransomware group has provided specific figures regarding the scale of the alleged theft and the financial demands following the incident. According to the group's announcement, they claim to have exfiltrated 300 GB of data from the target organization. This volume of data suggests a substantial breach of the institution's digital environment.

In addition to the claim of data theft, the group has issued a ransom demand of 15,000,000 USD. This massive financial demand is a central component of their extortion attempt. The group's tactics appear to align with the concept of double extortion, a method where attackers not only encrypt an organization's systems but also steal sensitive data to threaten its public release, thereby increasing the pressure on the victim to pay the ransom.

Regarding the specific contents of the breach, the listing names no specific data types, though the group makes reference to the institution's big data systems.

The Ministry of Labour of Thailand

The target of this alleged attack is the Ministry of Labour of Thailand. This government agency is responsible for managing labor policies, promoting employment, and protecting workers' rights within the country. As a central authority for labor and employment, the ministry handles significant amounts of information related to the national workforce and economic stability.

Implications and risks for government infrastructure

This leak claim indicates a potential unauthorized access risk within the institution's digital infrastructure. Given that the target is a government entity, there may be a risk of exposure concerning sensitive citizen information or strategic state data. Such a breach carries heavy implications for national security and public trust in digital governance.

The potential consequences of such an event are multifaceted. From a regulatory perspective, this situation could lead to legal proceedings and administrative sanctions under Thai data protection regulations. Furthermore, there is a significant risk that the leaked data could be utilized by malicious actors for identity theft or targeted phishing attacks against citizens or government officials.

In the broader context of cyber threats, ransomware groups often target government sectors due to the sensitive nature of the data they manage. To mitigate such risks, organizations in this sector typically focus on strengthening their defensive posture through several common practices. These include implementing robust access controls, maintaining rigorous patch management protocols, and conducting regular security audits. Additionally, organizations often employ continuous monitoring of their networks to detect unauthorized exfiltration attempts and maintain comprehensive backup strategies to ensure data integrity and availability.