Cyber Incident Victim: Argentina's Judiciary of Córdoba
Date:
Aug 2022
Location:
Argentina
Summary
Argentina's Judiciary of Córdoba suffered a disruptive ransomware attack attributed to the PLAY operation, leading to the shutdown of IT systems and online portals while forcing reliance on manual processes for official documentation. The attack compromised system availability and databases, with ransomware appending the '.Play' extension to encrypted files and deploying minimal ransom notes. The Judiciary engaged multiple cybersecurity firms and local specialists to investigate the incident, which was described as one of the most severe against public institutions. While no data theft occurred, the intrusion potentially leveraged previously leaked employee credentials from an unrelated breach to facilitate initial access via phishing.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On August 13, 2022, Argentina's Judiciary of Córdoba experienced a ransomware attack that compromised its technological infrastructure, forcing an immediate shutdown of IT systems and its online portal. The attack disrupted court operations, necessitating a shift to manual processes such as submitting official documents via pen and paper. The Judiciary confirmed the incident through a 'Cyberattack Contingency Plan,' disclosing collaboration with Microsoft, Cisco, Trend Micro, and local cybersecurity specialists to investigate the breach. Sources cited by Clarín described the incident as the "worst attack on public institutions in history," affecting IT systems and critical databases. The ransomware was identified through encrypted files appended with the '.Play' extension, a signature of the then-emerging PLAY ransomware operation active since June 2022. Unlike typical ransomware strains, PLAY deployed minimalistic ransom notes—a 'ReadMe.txt' file containing only the word "PLAY" and a contact email—placed at the root of infected drives.
Initial analysis suggested attackers may have exploited employee email addresses leaked during a March 2022 Lapsus$ breach targeting Globant, a software company, potentially using phishing to steal credentials. While no data exfiltration was confirmed, PLAY’s encryption method rendered systems inoperable. The Judiciary’s response focused on containment, isolating affected infrastructure to prevent lateral movement. Historical context revealed prior ransomware incidents in Argentine government agencies, including a 2020 Netwalker attack on the Dirección Nacional de Migraciones that demanded a $4 million ransom. Operational disruptions persisted post-attack, with recovery efforts prioritizing system restoration and forensic analysis to identify vulnerabilities. The incident underscored systemic risks to public-sector digital infrastructure, though no ransom payment or data leaks were publicly reported in its immediate aftermath.