Argentine National Securities Commission

History

2023: Stealing 1.5 TB of data. Hackers demand a ransom of $500 thousand and promise to destroy the banking system

In June 2023, the Argentine National Securities Commission was the victim of a cyber attack allegedly committed by the hacker group Medusa, which develops ransomware viruses. Hackers demand a large ransom of $500,000 within a week, otherwise threatening to leak 1.5 TB of documents and commission databases to the Internet.

According to Bleeping Computer, the ransomware operation Medusa began operations in June 2021. However, it has gained significant momentum since early 2023, targeting corporate victims around the world with multi-million dollar ransom demands. Since May 2023, hackers from Medusa have stepped up their activities by launching their blog. This platform serves to leak the data of victims who refused to pay a ransom, which attracts increased media attention.

Argentina's National Securities Commission targeted by Medusa cyber attack

Sensitive files and records are reportedly at risk of leaking, according to Bleeping Computer, which could potentially shake Argentina's financial markets. Argentina's National Securities Commission, as of June 13, 2023, has yet to release an official statement on the hack.

The attack on the Argentine financial regulator marks just one more line of major attacks on a large list of hackers from Medusa. It is noteworthy that a group of ransomware in May 2023 claimed responsibility for an attack on a large cancer center in Australia, during which hackers demanded a ransom of $100 thousand. In April 2023, hackers also posted the source code of Microsoft Bing and Cortana services on the Internet.

The Medusa ransomware gang began operating around the end of 2022. The Medusa ransomware virus is believed to run on a ransomware-as-a-service (RaaS) model and attacked at least 18 organizations around the world in February 2023 alone. The virus supports many arguments that can change the principle of its operation. On normal startup, the software automatically shuts down more than 280 Windows services and processes so that nothing prevents file encryption. The malware then searches for and deletes OS backups to prevent them from being used to recover files.^[1]

Notes