Cyber Incident Victim: Ministry of Public Works and Communications
Date:
Jun 2025
Location:
Paraguay
Summary
The Ministry of Public Works and Communications along with the National Health Surveillance Directorate, the General Audit of the Executive Power and the Ministry of Environment and Sustainable Development experienced unauthorized access to their web portals after attackers used leaked credentials obtained through infostealer malware. The Ministry of Technology and Information and Communication activated its incident response protocol, coordinating with the information security officers of the affected institutions and the national cyber‑incident center to contain the breaches. The incidents have been contained and are under investigation.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On June 1, 2025, the Ministry of Technologies of Information and Communication (MITIC) reported that unauthorized accesses had been detected on the digital portals of several state institutions. The affected institutions included the Ministry of Public Works and Communications (MOPC), the National Directorate of Health Surveillance (DINAVISA), the General Audit of the Executive Branch (AGPE), and the Ministry of Environment and Sustainable Development (MADES). According to MITIC’s investigation, the breaches resulted from the use of leaked user credentials. The leaked credentials were obtained through infection with a malware known as an “infostealer,” which is designed to extract and exfiltrate valuable data. Upon discovery, MITIC activated its incident response protocol and began coordinating with the Paraguayan Cyber Incident Response Center (CERT‑PY) and the information security officers of each affected entity.
The coordinated response led to the containment of the unauthorized accesses, and the compromised digital pages were secured. No further compromise or ongoing activity was reported after the containment actions were completed. MITIC stated that the incidents had been contained and that normal operations of the affected portals could resume. The response involved technical analysis, credential reset procedures, and monitoring for any residual indicators of compromise.
For reporting any cybersecurity incident, individuals and organizations are instructed to contact the email address [email protected]. CERT‑PY maintains a public repository of statistics on handled reports, accessible via its website at www.cert.gov.py/estadisticas/. MITIC noted that the statistics are available for consultation as part of its transparency efforts.