Supreme Administrative Court of Bulgaria listed by Ransomhouse

• Ransomware group: Ransomhouse
• Country: Bulgaria
• Sector: Government & Defense
• Announcement date: February 19, 2025

The Ransomhouse ransomware group has listed the Supreme Administrative Court of Bulgaria on its leak site, claiming to have obtained the institution's data. This announcement marks a significant escalation in the ongoing extortion efforts directed at the Bulgarian judicial infrastructure.

The details of the claim

According to the announcement made by the threat actor known as Ransomhouse on February 19, 2025, the Supreme Administrative Court of Bulgaria has been targeted in a cyberattack. The group claims that they successfully gained access to the institution's systems as early as January 27, 2025. Following this initial breach, the group has been engaging in extortion activities, utilizing the threat of publishing the institution's data to pressure the target.

Ransomware attack patterns often involve a strategy known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information before the encryption phase. The goal is to threaten the victim with the public release of this stolen data on a dedicated leak site if the ransom demands are not met. This tactic places immense pressure on organizations, as the threat of a data leak can cause significant reputational and legal damage, even if the organization can restore its systems from backups.

Information regarding the leaked data

At this stage of the incident, the group has not provided any screenshots or detailed information regarding the nature of the allegedly leaked data. Furthermore, the listing does not specify the volume of data stolen or the total number of files involved. The group has also not publicly disclosed the specific ransom demand required to prevent the publication of the data.

• No specific data types were named in the listing.

The Supreme Administrative Court of Bulgaria

The Supreme Administrative Court of Bulgaria serves as the highest judicial body within the country's administrative justice system. Its primary function is to provide supreme judicial supervision over the precise and uniform application of laws in administrative justice. The court is responsible for resolving disputes regarding the legality of administrative acts and reviewing the quality of judicial decisions rendered in administrative cases.

Implications and organizational risks

This incident highlights the potential risks associated with data leak claims targeting public institutions. Given the judicial functions of the Supreme Administrative Court, the leaked data may contain sensitive legal documents and personal information. Such a breach could lead to privacy violations for the individuals involved and create secondary risks, such as identity theft. Furthermore, a leak claim against a core component of the judicial system may raise questions regarding the institution's reliability and could trigger legal processes under data protection regulations such as the General Data Protection Regulation (GDPR).

For organizations operating within the government and defense sectors, these types of threats underscore the necessity of robust cybersecurity frameworks. Defending against such sophisticated actors requires a multi-layered approach to security. Organizations typically focus on several defensive pillars to mitigate these risks:

• Network Segmentation: Dividing a network into smaller sub-networks to prevent attackers from moving laterally through the system after an initial breach.
• Endpoint Detection and Response (EDR): Utilizing tools that monitor end-user devices to detect and respond to malicious activities in real-time.
• Data Encryption: Implementing strong encryption for data at rest and in transit to ensure that even if data is exfiltrated, it remains unreadable to unauthorized parties.
• Regular Auditing and Patch Management: Consistently updating software to close vulnerabilities and conducting audits to identify potential weaknesses in the perimeter.

Information regarding the Ransomhouse group remains limited, making it difficult to determine the full scope of their operations or their specific technical methodologies.