Beginning on the night (UTC-6:00) of April 17, 2022, a ransomware attack began against nearly 30 institutions of the government of Costa Rica, including its Ministry of Finance, the Ministry of Science, Innovation, Technology and Telecommunications (MICITT), the National Meteorological Institute, state internet service provider RACSA, the Costa Rican Social Security Fund (, CCSS), the , the Fund for Social Development and Family Allowances, and the Administrative Board of the Municipal Electricity Service of Cartago.
The pro-Russian Conti Group claimed the first group of attacks and demanded a US$10 million ransom in exchange for not releasing the information stolen from the Ministry of Finance, which could include sensitive information such as citizens' tax returns and companies operating in Costa Rica.
As a consequence, the government had to shut down the computer systems used to declare taxes and for the control and management of imports and exports, causing losses to the productive sector on the order of US$30 million per day. Likewise, the web pages of the Ministry of Science, Innovation, Technology and Telecommunications were removed from the network.
Costa Rica required technical assistance from the United States, Israel, Spain, and Microsoft, among others, to deal with the cyber attack. The attack consisted of infections of computer systems with ransomware, defacement of web pages, theft of email files and attacks on the Social Security human resources portal, as well as on its official Twitter account.
On May 6, 2022, the United States government through the FBI offered a US$10 million reward for information leading to the identification of a person or persons in a leadership position within the Conti Group, and an additional US$5 million for information leading to the capture or conviction, in any country, of individuals who aided or conspired to carry out Conti ransomware attacks.
On May 8, 2022, the new president of Costa Rica, Rodrigo Chaves Robles, decreed a state of national emergency due to cyber attacks, considering them an act of terrorism. Days later, at a press conference, he stated that the country was in a state of war and that there was evidence that people inside Costa Rica were helping Conti, calling them "traitors" and "filibusters".
On May 31, 2022, at dawn, the Hive Ransomware Group carried out an attack against the Costa Rican Social Security Fund, forcing the institution to turn off all of its critical systems, including the Unique Digital Health File and the Centralized Collection System. The former stores sensitive medical information of patients using Social Security, while the latter is used to collect the population's insurance fees.
Background Conti Group
Conti Group is a criminal organization dedicated to carrying out ransomware attacks, stealing files and documents from servers and then demanding a ransom. Its modus operandi is to infect computers with the Conti malware, which operates with up to 32 individual logical threads, making it much faster than most viruses of its kind.
The oldest member is known by the aliases Stern or Demon and acts as CEO. Another member known as Mango acts as the general manager and communicates frequently with Stern. Mango told Stern in a message that there were 62 people on the core team. The numbers of people involved fluctuate, reaching up to 100. Due to the constant turnover of members, the group recruits new members through legitimate job recruitment sites and hacker sites.
Ordinary programmers earn $1,500 to $2,000 per month, and members who negotiate ransom payments can take a cut of the profits. In April 2021, a member of the Conti Group claimed to have an anonymous journalist take a 5% cut of ransomware payments by pressuring victims to pay.
During the Russian invasion of Ukraine of 2022, the Conti Group announced its support for Russia and threatened to implement "retaliatory measures" if cyber-attacks were launched against the country. As a result, an anonymous person leaked approximately 60,000 internal chat log messages along with source code and other files used by the group.
Opinions expressed in the leaks include support for Vladimir Putin, Vladimir Zhirinovsky, and antisemitism (including towards Volodymyr Zelenskyy). A member known as Patrick repeated several false claims made by Putin about Ukraine. Patrick lives in Australia and may be a Russian citizen. Messages containing homophobia, misogyny and references to child abuse were also found.
Conti has been responsible for hundreds of ransomware incidents since 2020. The FBI estimates that, as of January 2022, there were more than 1,000 victims of attacks associated with Conti ransomware with victim payouts exceeding $150 million, making Conti's the most damaging ransomware strain ever documented.
Days after the FBI's announcement, Conti announced that they would begin a shutdown process. Some of the Conti members migrated to smaller organizations like Hive, HelloKitty, AvosLocker, BlackCat, and BlackByteo; others founded groups of their own.
Hive Ransomware Group Hive ransomware group is a criminal organization known for attacking public health organizations and institutions, particularly hospitals and clinics. It first appeared in June 2021.
Bleeping Computer LLC reported that some of the Conti hackers migrated to other ransomware gangs, including Hive though the rival group has denied having any connection with Conti, despite that, once the process of closing operations began and its hackers reached Hive, it then began to employ the tactic of publishing leaked data on the deep web, just as Conti had. AdvIntel expert Yelisey Boguslavskiy identified, with a high level of certainty, that Conti had been working with Hive since at least November 2021. According to her information, Hive was actively using the initial attack access provided by Conti. Unlike the Conti Group, Hive is not associated with direct support for the Russian invasion of Ukraine, even though the ransom payment to Hive is likely to be received by the same people within Conti who claimed the group's collective alignment with the Russian government.
In July 2022, the FBI infiltrated Hive. Undercover Tampa, Florida Field Office agents acquired full access and acted as a subsidiary in the Hive network undetected for seven months, while gathering evidence and secretly generating decryption keys for victims to recover their data. in January 2023, the United States Department of Justice announced that they had dismantled Hive by seizing the group's servers, in coordination with Germany and the Netherlands.
Attacks
Conti Group attack The servers of the Ministry of Finance were the first to be compromised during the night of Sunday, April 17. The Conti Group had compromised credentials, which allowed it to install malware on one device in the Ministry of Finance network. The BetterCyber (Now VenariX) Twitter account was the first to replicate, the next day, the post on the Conti Group forum that reported the hacking of the government institution, indicating that 1 terabyte of information had been stolen from the Virtual Tax Administration (ATV) platform, used by the government for citizens and companies to file their tax returns. In turn, the publication indicated that the data would begin to be published on April 23.
Before 10 a.m. on April 18, the Ministry of Finance informed through a press release and through its social networks that, "due to technical problems", the ATV platform and the Customs Information System (TICA) had been disabled and that the deadline for filing and paying taxes that were due that day would be extended until the next business day after the systems were restored. The institution did not immediately acknowledge being hacked and initially refused to answer questions from the press about the Conti Group claim.
The next day, Conti Group posted a new post on their forum announcing that they were asking for US$10 million in ransom for the stolen information. The Ministry of Finance confirmed that the information published so far corresponded to information from the National Customs Service, used for supplies and support.
Hours after the Treasury statement, the microsite of the Ministry of Science, Innovation, Technology and Telecommunications suffered a defacement with a message reading, "We greet you from Conti, look for us on your network."
Jorge Mora Flores, director of Digital Governance of Costa Rica, indicated that as a result of the attack, and because the affected server hosts other pages, the decision was made to turn it off while checks were carried out to determine to what extent security was breached. Subsequently, an update on the Conti Group forum indicated that the attacks against Costa Rican ministries would continue "until the government pays us".
Hours later, Conti attacked an email server of the National Meteorological Institute, stealing the information contained therein. Conti stated that the scenario that Costa Rica was experiencing was a "beta version of a global cyber attack on an entire country". Later, in another update on their forum, they indicated that if the Ministry of Finance did not inform their taxpayers of what was happening, they would carry out additional actions:
Later that day, the Costa Rican government denied having received a ransom request, despite Conti Group's forum post regarding the US$10 million.
On April 20, Conti published an additional 5 GB of information stolen from the Ministry of Finance. In the afternoon, the Government called a press conference at the Presidential House where it argued that the situation was under control, and that in addition to the Treasury, MICITT and the IMN, (RACSA), a state internet service provider, had been attacked through an internal email server breach. In the meantime, the Costa Rican Social Security Fund reported having suffered a cyber attack on its human resources site, which was being combated. Conti Group did not claim responsibility for the attack, since the Fund reported hours later that no sensitive information was stolen from the insured, such as their medical history or contributions to pension or health insurance, and that the databases had been left behind intact.
The Minister of the Presidency, Geannina Dinarte Romero, indicated that this was a case of international organized crime and that the Government of Costa Rica would not pay any ransom. She also announced that they were receiving technical assistance from the governments of the United States, Israel and Spain, as well as from Microsoft, which operated the servers of the Ministry of Finance.
Early on April 21, Conti Group attacked the servers of the Ministry of Labor and Social Security, as well as the Social Development and Family Allowances Fund. The preliminary report of the government indicated that information such as emails and data on pension payments and social aid from both institutions was stolen. Likewise, the group offered a 35% discount on the amount of the ransom demanded if the Government of Costa Rica made a prompt payment. Before noon, the Ministry of Science, Innovation, Technology and Telecommunications held a press conference where the Government reiterated its position of not paying the ransom demanded by the Conti Group, for which hours later the criminal group announced that it would immediately begin publishing the stolen information, urging Costa Rican cybercriminals to take advantage of it to commit phishing.
President Carlos Alvarado Quesada gave his first public statement on the hack that day.