RansomHub ransomware group lists dpfza.gov.dj on its leak site

• Ransomware group: RansomHub
• Country: Djibouti
• Sector: Government & Defense
• Announcement date: August 28, 2024

RansomHub claims to have breached Djibouti Ports & Free Zones Authority

The RansomHub ransomware group has listed the Djibouti Ports & Free Zones Authority (dpfza.gov.dj) on its dedicated leak site. According to the announcement made on August 28, 2024, the threat actors claim to have successfully infiltrated the organization's networks. This incident follows a claimed attack date of August 27, 2024, marking a potential targeted operation against a critical government entity.

Ransomware groups often employ a tactic known as double extortion, where they not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to publish stolen data on public leak sites, these groups aim to pressure victims into paying ransoms to prevent the disclosure of confidential records. Such leaks can cause significant reputational damage and legal complications for the targeted entities.

Details of the alleged data theft

The threat actors claim to have gained access to various administrative documents and operational records. The announcement suggests that the breach involves a variety of sensitive files related to the organization's internal processes. While the specific volume and file count of the stolen data have not been disclosed by the group, the leaked information appears to include several critical categories of documentation.

Based on the images shared by the group, the following types of data are reportedly involved in the leak:

• Employee payroll information
• Bank account details
• Financial transaction records
• Corporate invoices

The exposure of such diverse datasets, ranging from personal employee records to corporate financial communications, highlights the broad scope of the alleged intrusion. The inclusion of utility bills and bank transfer instructions further indicates that the attackers targeted the administrative and financial core of the organization.

The Djibouti Ports & Free Zones Authority profile

The Djibouti Ports & Free Zones Authority (DPFZA) is the government body responsible for managing the strategic ports and free zones in Djibouti. The authority oversees international logistics and trade operations, aiming to position the country as a leading maritime and commercial hub in Africa. Given its role in managing strategic maritime and commercial infrastructure, the organization plays a vital part in the region's logistics and trade ecosystem.

Risk assessment and potential implications

The disclosure of this information carries several significant risks. The exposure of personal and financial information belonging to the organization's employees increases the risk of identity theft and fraud. Furthermore, the leak of corporate financial data, such as bank transfer instructions and account statements, could create secondary risks for the organization's supply chain partners. Such a breach can potentially damage the organization's commercial reputation and trust within the international trade community.

The identity of the threat actor, RansomHub, is notable as the group was active in early 2024 and has been reported to have links to ALPHV. This connection suggests that the attack may have been carried out with a targeted motivation. Additionally, the organization may face legal liabilities under Djibouti's data protection regulations due to the exposure of sensitive information. There is also a high possibility that the leaked data could be utilized in future phishing campaigns to target employees or business partners.

For organizations operating in the government and defense sectors, particularly those managing critical infrastructure like ports, maintaining robust cybersecurity defenses is essential. Common defensive measures include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits to identify vulnerabilities. Monitoring for unauthorized access to administrative networks and ensuring strict data protection compliance are also critical steps in mitigating the impact of such targeted ransomware campaigns.