Cyber Incident Victim: Comando Conjunto de las Fuerzas Armadas Del Ecuador
Date:
Oct 2022
Location:
Ecuador
Summary
The Joint Command of the Armed Forces of Ecuador denied claims of a ransomware attack by the BlackCat group after its website became inaccessible, attributing the outage to preventive maintenance rather than a breach. Military cyber investigators confirmed no compromise of systems, dismissing BlackCat's leak site listing of the organization as a victim. BlackCat, linked to earlier ransomware operations like DarkSide and BlackMatter, has been implicated in numerous global attacks, with law enforcement agencies tracking its widespread activity. The incident occurred amid a broader pattern of ransomware operations targeting government and military entities across Latin America.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On October 26, 2022, the BlackCat ransomware group listed the Joint Command of the Armed Forces of Ecuador on its leak site, prompting speculation of a cyberattack. This occurred amid regional ransomware incidents targeting government entities in Central and South America. Ecuador's military responded through an official Twitter statement on Saturday, denying any system compromise or data breach. The Cyber Defense Command conducted an investigation following the rumors and concluded that no digital systems or websites operated by the Joint Command had been compromised at any level. Military officials attributed their website's downtime to scheduled preventive maintenance described as a safety measure, with systems to be restored after unspecified technical work. No evidence of data theft or encryption was acknowledged, and the military did not confirm any communication with BlackCat operators.
The incident unfolded against a backdrop of escalating ransomware activity across Latin America, including confirmed attacks on Argentina's capital legislature in September 2022, Córdoba's Judiciary in August 2022, Chile's unnamed government agency, and the Dominican Republic's departmental systems in late August. BlackCat's prominence as an emerging threat was noted, with the FBI documenting at least 60 confirmed attacks by the group as of March 2022. Historical connections were drawn between BlackCat and earlier ransomware operations like BlackMatter and DarkSide, though no technical evidence linked these groups to the Ecuador incident. The military maintained full denial of operational impacts beyond maintenance-related website unavailability, distinguishing their situation from contemporaneous regional attacks that disrupted government functions in Costa Rica and Brazil.