Fabricaciones Militares

Summary

Fabricaciones Militares suffered a ransomware attack carried out by the group MONTI, which encrypted systems and exfiltrated over three hundred gigabytes of data, including plans for advanced weapons projects such as upgrades to the TAM 2IP main battle tank and development of a CH‑14 helicopter. The attackers claimed responsibility, criticized the company’s insufficient cooperation, and indicated that negotiations for data recovery were underway. The incident occurred amid a broader Interpol warning about ransomware targeting defense contractors in neutral countries and followed a series of hacks affecting government platforms. The company, currently transitioning to a public limited company with privatization plans, faces additional uncertainty as more than a thousand workers see their future at risk.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In early March 2025, specialized media outlets FalconFeeds.io and Cyber Press reported that Fabricaciones Militares, the Argentine state‑owned defense manufacturer, had suffered a ransomware attack. The attackers, identifying themselves as the MONTI group, claimed responsibility for encrypting the company’s files and exfiltrating more than 300 gigabytes of data. According to the reports, the stolen material includes sensitive information such as plans for cutting‑edge weapons projects, specifically the upgrade of the TAM 2IP main battle tank and the development of a CH‑14 helicopter. The attack occurred while Fabricaciones Militares was undergoing a dismantling process and the government of Javier Milei had announced its intention to privatize the company, a transition that would convert it into a public limited company. The timing of the breach coincided with an Interpol alert issued in 2024 that warned of increasing ransomware interest in defense contractors situated in geopolitically neutral countries.

The breach prompted an official silence from Argentine authorities, with no public statement issued regarding the incident or its potential consequences. Because Fabricaciones Militares supplies the Villa María Military Powder and Explosives Factory, the disruption raised concerns about the continuity of munitions production for that facility. Media coverage noted that more than a thousand workers faced an uncertain future after the auction of equipment and vehicles from the Military Manufacturing division, a process linked to the anticipated privatization that could see control transferred to firms associated with NATO and the United States, which have interests in ammunition and explosives manufacturing. The exposure of design data for next‑generation platforms, including the TAM 2IP tank upgrade and the CH‑14 helicopter project, represents a direct risk to Argentina’s defense capabilities. The incident followed a series of cyber intrusions at the end of 2024 that compromised the “Mi Argentina” platform and roughly twenty other government websites, underscoring pre‑existing weaknesses in the nation’s public‑sector cybersecurity posture.

FalconFeeds.io and Cyber Press were the first to disclose the attack, bringing the ransomware nature and the MONTI group’s claim to public attention. The MONTI group subsequently posted on its dark‑web portal, mocking the management of Fabricaciones Militares for what it described as insufficient cooperation, a comment that Cyber Press interpreted as indicating that negotiations were underway to attempt to recover the stolen information. No official containment, mitigation, or recovery measures have been reported by the government or the company, and the lack of an official statement has left the details of any response actions unclear.

Sources

Sources available to members: 1 source.