Recently, Costa Rica has been in the news a lot, especially after President Rodrigo Chaves Robles proclaimed a state of emergency. Following a string of ransomware assaults that paralyzed Costa Rica’s economy, various government agencies, and the general public sector, the announcement was made.

Since many people in Latin America are accustomed to this, it should come as no surprise that Costa Rica has a weak cybersecurity infrastructure and has experienced cyberattacks before. The majority of Costa Rican firms, including manufacturing and other companies with weak infrastructure, saw over 1200 intrusions on a weekly average in 2021, according to Bleeping Computer. The gang responsible for the hack, Conti, claimed to have over 670GB of government data and this time targeted the Costa Rican government. Conti demanded rising ransoms from the Costa Rican government.

The Costa Rican government’s lack of preparation for such widespread cyberattacks left them without the resources to incite any kind of incident response to lessen and limit the damage, leaving Conti with the upper hand even with the time they had between Conti’s threats and their decision to expose some of the data they had retrieved.

What precisely happened, then? Conti: Who or what is he? Could all of this have been avoided, or even merely contained? Is it already over? Below, we examine these responses as well as others.

Why is Costa Rica under a state of emergency following the cyberattack using the Conti ransomware?

The national state of emergency was proclaimed by President Rodrigo Chaves Robles on May 8, the same day he assumed office as Costa Rica’s newly elected leader. Following the nation’s month-long battle with ransomware assaults that have badly damaged the economy, Chaves made the announcement. At the time, it was calculated that the country was losing at least $38 million every day due to the economy’s stagnation.

What is the Costa Rican Conti ransomware attack?

Large-scale ransomware assaults launched by Conti, a well-known ransomware gang, hit Costa Rica on April 17th, 2022. The nation’s Ministry of Finance was the primary target of the hackers, and it was it that announced the attack on Twitter on April 18th. When Carlos Alvarado Quesada was still in office, the government refused to pay Conti’s $10 million ransom demand. The first government agency Conti affected was the Ministry of Finance. A number of digital financial services, including payments, filing taxes, billing for services, and more, came to a standstill when the tax administration and customs systems were made inoperable.

On May 8, after President Chaves’ outspoken refusal to pay the ransom, Conti published 97% of the material they had been using as collateral online.

According to President Chaves, it was established that by May 16th, there were twenty-seven institutions in Costa Rica that had been affected. Around this time, Conti increased their ransom to $20 million, probably believing that the harm they had already done would be sufficient to force the government to relent. The hacker organization threatened to erase the recovery keys and leave the government and its people stranded if the ransom was not paid by May 23. The group urged Costa Rican citizens to exert pressure on their government to pay the demanded sum.

At this time, Costa Rica contacted Joe Biden, the president of the United States, whose law enforcement offered a $15 million reward to anyone who could help identify and hunt down Conti by providing information about his activities.

Although the primary motivation behind ransomware is monetary gain, in the instance of Conti and Costa Rica as a target, the circumstances go beyond Costa Rica simply being a victim who was arbitrarily chosen owing to their network and infrastructure vulnerabilities. Even though Conti may not have intended to make a political statement, the geopolitical situation and their connection to Russia were key factors in Costa Rica’s ransomware attack.

Conti lost a lot of public favor after publicly endorsing Russia’s invasion of Ukraine. “Their political attitude was exposed by their anti-US and anti-West sentiments, which also caused groups that had previously supported them to withdraw their support.

In order to maintain a low profile, targeting major corporations and countries like the United States was no longer a good idea, so they started targeting smaller countries in Latin America because they have less security and a weaker capacity for cyber response, according to Guy Rosefelt, Chief Product Officer at Sangfor Technologies, in a webinar. “So the amount of ransom they collected in the last few months significantly declines,” he continues.

This didn’t fully result in their redemption, so Conti decided it was best to use Costa Rica as a getaway plan. They made the attack in Costa Rica their swan song. They devised a plan to successfully infiltrate and attack Costa Rica after scouring Latin America because they anticipated having to leave shortly. So, this served as Conti’s last performance before purportedly breaking up. If the Costa Rica ransom had been paid, it would have been their final victory and only hope.

Of course, whether or not they succeeded in achieving that objective does not imply that their business is now completely shut down. It is common knowledge that when ransomware groups disband, it simply indicates that its members have joined subgroups or other organizations. This would explain the “coincidental” cyberattack that occurred in late May 2022 against Costa Rica’s public health system and social security fund, CSS.

This attack’s scope was equally harmful because it had an impact on public health systems like COVID-19 testing and tracking and compelled hospitals across the nation to fall back on pen and paper as a backup. Since HIVE is notorious for attacking international healthcare institutions, this attack is consistent with their strategy.
Even though they explicitly denied any connection to Conti on their website, the alignment with Conti’s activities has continued to draw attention.

These attacks’ aftereffects are still being felt in Costa Rica, and it doesn’t appear that it will soon make a full recovery.

What is Ransomware as a Service, or RaaS?

The phrase “ransomware as a service” (RaaS) describes the practice of using ransomware as a tactic or business model. Ransomware services are sold to customers by organizations like Conti through servers.

In order to infect the systems of target organizations at the affiliate or buyer’s request, ransomware developers construct distinctive ransomware codes, which are subsequently used by ransomware operators. Like any other business, this service may be paid for by a one-time fee or by the proceeds generated by the ransomware code. However, many of the business models employed by cybercrime organizations are subscription-based, with perks like forum inclusion, round-the-clock help, and bundling. To learn more about securing your organization’s infrastructure, see Expert Tips on Improving Organizational Cyber Defense.

Of course, Conti is not the only cybercrime gang to carry out this operation; DarkSide and REvil are two other well-known Ransomware as a Service organization. DarkSide claims to no longer exist, but in reality, they did so after a 2021 attack that shut down the Colonial Pipeline for six days, causing indignation among the people and DarkSide to declare their dissolution. The organization is alleged to have received more than $90 million in just nine months and to have stolen and leaked more than 2TB of data.

Another Russian-based vendor of RaaS was REvil. Since they started operating in April 2019, when another RaaS organization known as GrandCrab stopped its activities, it is anticipated that they have received more than $200 million. Ransomware was the most common sort of cyberattack in 2021, and according to IBM, 37% of the attacks were carried out by Ravil. According to the New York Times, the Russian security agency MOSCOW asserted that REvil had been shut down following a scan of five Russian districts.

Although ransomware assaults can have a similar character, gangs are usually picky about the targets they choose. For instance, HIVE has a history of targeting healthcare facilities, whereas DarkSide has refrained from assaulting hospitals, non-profits, and educational institutions. This just serves to demonstrate that everyone has the potential to become a target.

Use Sangfor products to protect yourself from hacks like the Costa Rican Conti ransomware attack.

Ransomware like Conti is pushed by unethical hackers who have the knowledge to get past firewalls and other common protection measures while using extremely skilled phishing techniques to infiltrate networks. This means that defending against more complicated attacks calls for cybersecurity methods and anti-ransomware solutions that are equally capable, even if they are not complex, and Sangfor offers both.

The surroundings of your company will be regularly monitored by ransomware defense technology. For constant protection against threats, automated and ongoing threat detection is required.

Sangfor’s solutions combine network monitoring and endpoint security tools to create a continuous platform for convergent threat detection and response.

In order to ensure that there have been no breaches at any point in the attack chain, Sangfor’s XDDR (Extended Detection, Defense and Response) framework uses a firewall that communicates directly with endpoint security. Should any breaches be discovered, the response is immediate to eliminate all threats while also tracing the origins and repairing any points of weakness. The results of vulnerability scans are relayed back to our NGAF (Next Generation Application Firewall), ensuring that all points of data circulation are covered for complete network visibility. Additionally, XDDR reveals hidden hazards both on-site and remote, especially in light of the increase in remote work.

Before and after integration, Sangfor conducts ongoing assessments to get a deeper understanding of any network flaws that present opportunities for improvement.

Finally, while relying just on backups is insufficient, integrating security solutions with Sangfor HCI enables regular cloud storage of backups for on-demand access. Your cloud, whether private, public, or hybrid, should be safe in today’s cloud-dominated world since it is essential to the inflow and outflow of organizational data.

Our extensive suite of cybersecurity products has been combined to provide a comprehensive cybersecurity strategy, risk management, and disaster recovery plan. As a result, we combine a variety of complex security and cloud computing solutions to produce a simple, secure, and manageable system that satisfies business needs boosts performance and safeguards your company. At Sangfor, we do not believe that there is a single platform that is a solution to every cybersecurity issue.

Can Costa Rica be said to have escaped the attack? Maybe not, but they could have surely decreased the effect. Guy adds in his presentation that Costa Rica “could have investigated more effective cyber screening measures earlier on.” The recording is accessible here.

It’s crucial to remember that some cyberattacks are unavoidable, but having a solid recovery strategy will help you minimize your damages. Business continuation depends on early discovery and quick action. Costa Rica serves as an illustration of what occurs when businesses and organizations of all stripes, including the government, fail to recognize the value of being prepared for digital disasters. An organization’s ability to manage its assets and recover from disasters that disrupt its processes and systems is enhanced by investing in cybersecurity solutions. Although Conti may have taken down their website and disappeared, Costa Rica is still feeling the effects of Conti.