Funksec Ransomware Breach Targets City of Skopje
Ransomware Attack on City of Skopje by Funksec
On December 16, the City of Skopje, the capital of North Macedonia, became the latest victim of a ransomware attack orchestrated by the cybercrime group Funksec. This incident highlights the vulnerabilities faced by municipal administrations in the digital age, as they manage critical public services and urban development.
Victim Profile: City of Skopje
The City of Skopje operates as a public administration entity, focusing on local governance and community services. With an employee count ranging between 501 to 1,000, it plays a crucial role in managing urban planning, public services, and budgetary oversight. Skopje's governance structure is defined by its City Council and the Mayor, who oversee various public enterprises contributing to the city's financial ecosystem. The city's robust economic standing, demonstrated by an operating surplus of 18% of its operating revenue in 2023, underscores its effective fiscal management.
Attack Overview
Funksec, an emerging ransomware group, claimed responsibility for the breach, offering administrative access to Skopje's official website, skopje.gov.mk, for $2,000. The group released a screenshot of exfiltrated data as evidence, although the full extent of the data leak remains unspecified. This attack, part of what Funksec calls a "funknight event," underscores the growing threat of ransomware to public sector entities.
Funksec: A Rising Threat
First observed in December 2024, Funksec has quickly gained notoriety for its double extortion tactics, combining data exfiltration with encryption to pressure victims. The group operates a Tor-based data-leak site, hosting breach announcements and a free DDoS tool. Funksec's activities suggest a diversification of extortion methods, potentially operating as a data broker. Their ability to penetrate systems like Skopje's may involve exploiting vulnerabilities in public sector cybersecurity frameworks, which often lag behind private sector standards.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!