Cyber Incident Victim: Instituto Agrario Dominicano
Date:
Aug 2022
Location:
Dominican Republic
Summary
A ransomware attack by the Quantum group targeted a Dominican Republic government agricultural agency, encrypting multiple physical and virtual servers, disrupting operations, and compromising databases, applications, and emails. The attackers demanded $650,000, threatening to release over 1TB of stolen data, while the agency lacked dedicated security infrastructure beyond basic antivirus software. Quantum, an offshoot of the Conti ransomware operation with ties to earlier MountLocker variants, leveraged compromised infrastructure linked to U.S. and Russian IP addresses. National cybersecurity authorities assisted recovery efforts amid the agency's operational paralysis due to widespread system encryption and data compromise.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On August 18, 2022, the Dominican Republic's Instituto Agrario Dominicano (IAD), an agency under the Ministry of Agriculture responsible for agrarian reform programs, suffered a disruptive ransomware attack attributed to the Quantum operation. The attack encrypted four physical servers and eight virtual servers, compromising databases, applications, email systems, and virtually all operational infrastructure. Quantum actors initially demanded a $650,000 ransom and claimed to have exfiltrated over 1TB of sensitive data, threatening public release unless payment was made. IAD's Director of Technology, Walixson Amaury Nuñez, confirmed the agency lacked a dedicated cybersecurity department and relied solely on basic antivirus software prior to the incident, leaving systems vulnerable to compromise. The encryption rendered critical services inoperable, severely disrupting the agency's agrarian reform operations and administrative functions.
The National Cybersecurity Center (CNCS) of the Dominican Republic intervened to assist with recovery efforts, identifying attacker IP addresses originating from the United States and Russia during their investigation. IAD officials publicly stated an inability to pay the ransom due to financial constraints, citing the demanded amount as unaffordable. Quantum ransomware emerged as a rebrand of the MountLocker operation in August 2021, adopting the .quantum file extension, and later absorbed members from the disbanded Conti ransomware group, leading to increased attack volumes. This infiltration by Conti affiliates coincided with Quantum's resurgence in mid-2022, aligning with the timing of the IAD breach. The incident highlighted systemic vulnerabilities within the agency's IT infrastructure, including insufficient defensive measures and reliance on outdated security practices, exacerbating the operational and data integrity consequences of the encryption and theft.