Corantioquia Hit by MEOW Ransomware Group in Major Cyber Attack
Ransomware Attack on Corantioquia: A Closer Look at the MEOW Ransomware Group's Latest Target
Corantioquia, officially known as the Corporación Autónoma Regional del Centro de Antioquia, has recently fallen victim to a ransomware attack by the MEOW ransomware group. This public entity, headquartered in Medellín, Colombia, is tasked with managing and protecting the environment in the central region of Antioquia. With a workforce of 201 to 500 employees, Corantioquia plays a pivotal role in promoting sustainable development through environmental management and community engagement initiatives.
Corantioquia's Role and Vulnerabilities
Corantioquia stands out in its industry due to its legal and financial autonomy, allowing it to implement various environmental policies and initiatives. The organization focuses on biodiversity conservation, ecosystem management, and climate change adaptation, collaborating with local communities to ensure effective conservation strategies. However, its status as a public sector entity makes it a prime target for cyber threats, as these organizations often face challenges in maintaining effective cybersecurity measures.
Details of the Ransomware Attack
The MEOW ransomware group claims to have exfiltrated 230 GB of data from Corantioquia, highlighting the vulnerability of public sector entities to sophisticated cyber threats. This breach underscores the critical need for comprehensive data protection strategies and incident response plans. The attack has the potential to severely disrupt Corantioquia's operations, affecting its ability to manage and protect the environment effectively.
Understanding the MEOW Ransomware Group
Emerging in late 2022, the MEOW ransomware group is associated with the Conti v2 ransomware variant. Known for its aggressive tactics, the group frequently targets industries with sensitive data, such as healthcare and medical research. MEOW employs various infection methods, including phishing emails, exploit kits, and Remote Desktop Protocol vulnerabilities. Once a system is compromised, the ransomware encrypts files using a combination of the ChaCha20 and RSA-4096 algorithms.
Potential Penetration Methods
The MEOW ransomware group could have penetrated Corantioquia's systems through several vectors. Given the group's history, phishing emails and exploiting RDP vulnerabilities are likely methods. The attack highlights the importance of maintaining up-to-date security protocols and employee training to recognize and respond to potential threats.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!