Loading story…
Colombia's Ministry of Justice confirmed that a ransomware attack struck part of its technology infrastructure on Aug. 2, disrupting public-facing services tied to illicit-drug monitoring and legal processes just days before the country's presidential transition. Acting Justice Minister Cielo Rusinque said some files were encrypted, while recovery efforts continued to restore affected systems.
Officials said the incident degraded ministry services but denied that data had been stolen, despite early reports of possible leakage. The attack came after Colombia's national CERT, ColCERT, warned that ransomware groups were increasingly targeting the country, and it adds to a broader wave of cyberattacks affecting Colombian government agencies and major state-linked enterprises amid rising exploit activity across Colombia and Latin America.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-02, a ransomware attack struck part of Colombia's Ministry of Justice technology infrastructure, degrading public-facing services. The incident disrupted services tied to illicit-drug monitoring and legal processes.
One day before the Justice Ministry attack, Colombia's national CERT, ColCERT, published threat intelligence warning that ransomware groups had increased their focus on the country.
In July 2026, Ecopetrol SA acknowledged a breach that compromised the IT networks of more than a dozen subsidiaries. The company said the incident likely leaked information on at least 3,300 users and continued evaluating possible exposure of confidential and personal data.
In March 2026, Colombia's national tax authority DIAN suffered an alleged compromise that was claimed by a hacker using the alias ArcRaidersPlayer.
In 2023, attacks on IFX Networks disrupted Colombia's Ministry of Health, the Judicial Branch, and the Superintendencia de Industria y Comercio.
After the attack, acting Justice Minister Cielo Rusinque said some files were encrypted and denied that attackers captured data, despite earlier media reports suggesting a leak. Recovery efforts were underway.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Russia-linked **Conti** ransomware group launched a sweeping attack on Costa Rican government networks in April 2022, disrupting tax collection, customs, payroll, and other critical public services and prompting the government to declare a national emergency. Costa Rican officials said at least 27 institutions were attacked and several were severely affected, with the Ministry of Finance among the hardest hit; additional incidents were reported at entities including **JASEC**, the Sede Interuniversitaria de Alajuela, and the Instituto de Desarrollo Rural. Authorities said data was stolen and progressively leaked, while restoration of key systems took weeks, including the eventual recovery of the customs platform after roughly two months of disruption. Conti escalated the crisis by raising its ransom demand from **$10 million** to **$20 million**, threatening to delete decryption keys, urging public pressure on the government, and later shifting tactics to target large private Costa Rican companies directly. President Rodrigo Chaves said the country was "at war" and alleged that local collaborators were aiding the extortion effort, though no proof was publicly detailed. As Costa Rica sought technical help from international partners and private-sector responders, the **U.S. State Department** offered rewards of up to **$10 million** for information identifying Conti leaders and up to **$5 million** for information leading to their arrest or conviction, underscoring the group's broader record of hitting more than 1,000 victims and extorting over **$150 million** worldwide.
Jun 29, 2026
Ecopetrol, Colombia's state-linked energy company, confirmed a ransomware-related intrusion after attackers accessed its IT infrastructure and stole pseudonymous data associated with **3,300 user accounts**. Reporting tied the incident to the threat group **thegentlemen**, with claims that more than **1 TB of data** was involved in the compromise of the company, which operates refineries, pipelines, ports, and international energy assets. The company said the attackers attempted to deploy an encryptor, but security controls blocked the encryption phase and prevented disruption to transactional systems and partner networks. Ecopetrol stated that no user identities or credentials were compromised, that the threat actors were removed from its environment, and that an internal investigation is underway; Colombian authorities, including the Attorney General's Office and the Military Forces' Joint Cyber Command, were also notified.
Jul 20, 2026
A ransomware attack hit Spain’s Port of Vigo, disrupting cargo traffic management systems and other digital services while forcing authorities to disconnect affected parts of the network. Port officials said some equipment was locked and the attackers sought a ransom payment, prompting cybersecurity teams to keep systems offline until they can verify the environment is secure. Investigators are still working to determine the initial access vector and whether any sensitive data was compromised. Physical port activity, including ship movements and cargo handling, continued, but logistics coordination through digital platforms was impaired and some cargo-related processes were shifted to manual operations. Port president Carlos Botana said there is no timeline for full restoration, underscoring the operational risk ransomware poses to ports and other maritime organizations that support critical trade flows.
Jun 29, 2026