Costa Rica declares state of emergency following Conti ransomware attack

The newly-inaugurated president of Costa Rica, Rodrigo Chaves Robles, reportedly declared a state of emergency on Sunday after the country’s government had been hit by Conti ransomware last month.

This is one of the first executive decrees the president has signed, after beginning his presidency on 8 May, as reported by journalist Amelia Rueda. It mandates the need for Costa Rica to invest in cyber security and respond to the ongoing attack.

The first entity to be hit was the Treasury on 18 April, although the full impact of the ransomware is still unknown. It has been without any kind of digital services, meaning that its processes have been forced to be completed manually.

On 6 May, the US Department of State also posted a $10 million bounty for information leading to the identification or location of any individuals who hold a key leadership position in the Conti ransomware group. The department is also offering a reward of $5 million for information leading to the arrest and/or conviction of any individual in any country conspiring to participate in a Conti ransomware incident. It underlined that the group attacked Costa Rica in April, impacting the country’s foreign trade by disrupting its customs and taxes platforms.

“We’ve signed the decree so the country can defend against the criminal attack that cyber criminals are carrying out,” added Chaves. “This is an assault on the nation and we have signed this decree to help us defend ourselves better.”

Conti has released a statement about the attack online where it said Costa Rica could have avoided this by paying a $10 million ransom, as reported by CyberScoop. The post also indicated that around 97% of the stolen data has been published so far, with around 672GB of information taken.

“You also need to know that no organised team was created for this attack, no government of other countries has finalised this attack, everything was carried out by me with a successful affiliate, my name is unc1756,” stated the message. “The purpose of this attack was to earn money, in the future I will definitely carry out attacks of a more serious format with a larger team, Costa Rica is a demo version.”

The message contained links to four Costa Rican websites: the Treasury, the Ministry of Work and Social Security, the Social Development and Family Allowances Fund, and SIUA, a local university.

"With cyberattacks on government and critical infrastructure organisations on the rise, we’re starting to see the very real and devastating consequences of cybercrime brought to life," said Christiaan Beek, lead scientist and senior principal engineer of Trellix Threat Labs. "Not only does the threat of this type of double extortion ransomware have major cost and data privacy implications, but the ongoing disruption to crucial operations such as utilities can impact human life. Malicious actors are using this attack technique as powerful leverage over governments for financial gain. Yet even in cases where the ransom is paid, significant resource will be needed to rebuild systems and processes, as well as manage the long-term consequences of stolen files being shared on the dark web."

In February, a Ukrainian cyber researcher unveiled data belonging to the Conti ransomware gang. The researcher had access to the group’s systems and released the data after the gang declared its support for Russia following the invasion of Ukraine. It includes Bitcoin addresses, chat logs, and negotiations between ransomware victims and Conti attackers.