In Mexico, several recognized organizations and companies have been affected by ransomware groups, including Mabe, OMA, Medicato, BP Jaguar, and UNAM. Among the groups responsible for these attacks is RansomHub, which sends malware to encrypt and hijack information, demanding large sums of money in exchange for releasing the data.
RansomHub operates globally, with at least ten active ransomware groups in Mexico. These groups avoid attacking certain countries, following strategies similar to others linked to Russia. According to reports, victims of RansomHub have between three and 90 days to make the payment before their data is published on their leak site. The CISA agency has identified RansomHub as one of the most prolific ransomware threats, with at least 210 victims, many of them in critical sectors in the United States.
It has been mentioned that RansomHub has recruited former affiliates from other ransomware groups, and possible connections between OMA employees and drug cartels have been hinted at, raising significant concerns about the situation. Regarding the OMA case, RansomHub has threatened to release all the information they possess next Saturday, November 2, which could affect passengers using airports in several Mexican cities.
Among the compromised documents are contracts, trade balances, payment receipts, and employment contracts. RansomHub is known to be one of the most dangerous ransomware groups globally, having carried out multiple confirmed attacks in the past, including on companies like Mabe and OMA. Recently, they have targeted several victims in Mexico, threatening to leak sensitive information if extortion payments are not received.
The hacker group has demonstrated that it possesses a large amount of sensitive data, even reaching 1.5 TB of information in some cases, a considerably high figure compared to other victims. RansomHub's attacks represent a serious threat to companies and institutions in Mexico and internationally, and it is crucial to remain vigilant in light of this increasingly dangerous cybersecurity situation.
