Cybercrime group RansomHouse has targeted the Namibian Defence Force in a ransomware attack, threatening to leak confidential information amid rising national cybersecurity vulnerabilities.
The hack, which an expert describes as potentially “extremely dangerous”, took place on Saturday.
RansomHouse has listed the Namibian Defence Force (NDF) as one of its victims and published an ‘evidence pack’, which it claims contains information showing it gained access to the defence force’s systems.
The group also posted a message directed at NDF management.
“Dear management of the Namibian Defence Force. We were waiting for you for quite some time, but it seems your IT department decided to conceal the incident that took place in your company. We strongly recommend you to contact us to prevent your confidential data, projects documents from being leaked,” the group’s message reads.
The attack comes as Namibia continues working on laws aimed at dealing with cybercrime and protecting personal information.
About six months ago, the drafting of the cybercrime bill was said to have been completed, with the legislation expected to be submitted to the parliament in March.
In July, minister of information and communication technology Emma Theofelus said the cybercrime and data protection bills were being finalised.
MINISTER ‘SHOCKED’
Minister of defence and veterans affairs Frans Kapofi says he is unaware of the extent of the attack.
He yesterday said he had only been informed that the ministry was experiencing difficulties accessing some information.
“What I was told is that they are experiencing difficulties accessing some of their information, and they are saying they are suspecting hacking,” he said.
The minister said he had not been informed about RansomHouse or its threats to the NDF.
“This is the first time I’m hearing it, and I’m even shocked that there is such a thing,” he said.
The NDF has also appeared on ransomware monitoring platforms tracking RansomHouse.
RansomLook recorded the NDF on RansomHouse’s victim list this week.
Cybersecurity monitoring platform SOCRadar also lists the NDF website in connection with a RansomHouse incident and classifies the threat as “data extortion”.
However, SOCRadar’s records raise questions about whether an earlier incident it recorded is connected to the latest attack. The platform recorded an incident on 28 April and listed the victim as a ‘Cybersecurity Vendor’ in the technology sector.
It classified the incident as data extortion and gave the claim an 85% confidence rating. SOCRadar does not identify the NDF as the victim in the incident in April.
The latest incident comes months after Namibian organisations were linked to another cybersecurity threat.
In June, a global cybersecurity incident known as FortiBleed may have exposed administrator credentials and firewall configuration data at 13 Namibian institutions.
Namibia also recorded more than half a million cyber-vulnerabilities between April and June this year, according to the Namibia Cybersecurity Incident Response Team (Nam-CSIRT), housed at the Communications Regulatory Authority of Namibia (Cran).
Nam-CSIRT’s second-quarter cybersecurity newsletter shows that 513 921 cyber-vulnerabilities were detected during the period. This was a 39.8% increase from the previous quarter.
Cyber-events also rose by 56.7% to 161 547 incidents.
STATE INFORMATION AT RISK
Cybersecurity expert Paulinus Sheehama warns that hackers gaining access to sensitive state or national security information could pose a serious threat to the country.
“If you do not adhere to their demands, they could expose the data or sell it on the dark web. That becomes extremely dangerous,” he says
