Ransomware gang that infiltrated some Costa Rican systems threatens to overthrow government

·3 min read

SAN JOSE, Costa Rica – A ransomware gang that infiltrated some Costa Rican government computer systems has upped its threat, saying its goal is now to overthrow the government.

Perhaps seizing on the fact that President Rodrigo Chaves had been in office for only a week, the Russian-speaking Conti gang tried to increase the pressure to pay a ransom by raising its demand to $20 million.

Chaves suggested Monday in a news conference that the attack was coming from inside as well as outside Costa Rica.

"We are at war, and that's not an exaggeration," Chaves said. He said officials were battling a national terrorist group that had collaborators inside Costa Rica.

Costa Rica's new President Rodrigo Chaves delivers a speech during his inauguration ceremony in San Jose, Costa Rica, on May 8, 2022. Economist and former finance minister Rodrigo Chaves was sworn in as Costa Rica's president for a four-year mandate focused on reinvigorating one of Latin America's most stable economies.
Costa Rica's new President Rodrigo Chaves delivers a speech during his inauguration ceremony in San Jose, Costa Rica, on May 8, 2022. Economist and former finance minister Rodrigo Chaves was sworn in as Costa Rica's president for a four-year mandate focused on reinvigorating one of Latin America's most stable economies.

Chaves also said the impact was broader than previously known, with 27 government institutions, including municipalities and state-run utilities, affected. He blamed his predecessor Carlos Alvarado for not investing in cybersecurity and for not more aggressively dealing with the attacks in the waning days of his government.

Despite Conti's threat, experts see regime change as a highly unlikely – or even the real goal.

"We haven't seen anything even close to this before, and it's quite a unique situation," said Brett Callow, a ransomware analyst at Emsisoft. "The threat to overthrow the government is simply them making noise and not to be taken too seriously, I wouldn't say.

"However, the threat that they could cause more disruption than they already have is potentially real."

In May 2021, the Russian-speaking ransomware group Conti demanded $20 million from Ireland's publicly funded health care system after a ransomware attack in which it threatened to publish private information.
In May 2021, the Russian-speaking ransomware group Conti demanded $20 million from Ireland's publicly funded health care system after a ransomware attack in which it threatened to publish private information.

Conti attacked Costa Rica in April, accessing multiple critical systems in the Finance Ministry, including customs and tax collection. Other government systems were also affected, and a month later not all are fully functioning.

Chaves declared a state of emergency over the attack as soon as he was sworn in last week. The U.S. State Department offered a $10 million reward for information leading to the identification or location of Conti leaders.

Conti responded by writing, "We are determined to overthrow the government by means of a cyber attack, we have already shown you all the strength and power, you have introduced an emergency."

The gang also said it was raising the ransom demand to $20 million. It called on Costa Ricans to pressure their government to pay.

The attack has encrypted government data, and the gang said that if the ransom wasn't paid in one week, it would delete the decryption keys.

The U.S. State Department statement said last week that the Conti group had been responsible for hundreds of ransomware incidents over the past two years.

"The FBI estimates that as of January 2022, there had been over 1,000 victims of attacks associated with Conti ransomware with victim payouts exceeding $150,000,000, making the Conti Ransomware variant the costliest strain of ransomware ever documented," the statement said.

While the attack is adding unwanted stress to Chaves' early days in office, it's unlikely there was anything but a monetary motivation for the gang.

"I believe this is simply a for-profit cyberattack," said Callow, the analyst. "Nothing more."

Contributing: AP writer Christopher Sherman in Mexico City

This article originally appeared on USA TODAY: Russian-speaking gang threatens to overthrow Costa Rica government

Our goal is to create a safe and engaging place for users to connect over interests and passions. In order to improve our community experience, we are temporarily suspending article commenting