Namibia Defence Ministry: RansomHouse Cyberattack Confirmed

• Namibia's Ministry of Defence and Veterans Affairs experienced unauthorized network activity, confirmed by NAM-CSIRT.
• The cyber incident has been linked to the RansomHouse ransomware group, known for its "double-extortion" tactics.
• NAM-CSIRT is actively coordinating the technical response, investigation, and remediation efforts in line with national guidelines.
• Authorities are urging all Namibian organizations to enhance cybersecurity practices, implement response plans, and promptly report incidents to NAM-CSIRT.

This incident underscores that no organization, regardless of its size or mandate, is impervious to the evolving landscape of cyber threats.

The Namibia Cyber Security Incident Response Team (NAM-CSIRT), operating under the Communications Regulatory Authority of Namibia (Cran), recently confirmed the detection of unauthorized network activity within the Ministry of Defence and Veterans Affairs (MODVA) environment. This significant cyber incident, impacting a critical government entity, was identified late last week. An in-depth analysis of the compromised systems subsequently linked the intrusion to the RansomHouse ransomware group, an international cybercriminal organization. This group is widely recognized for its deployment of sophisticated ransomware and its use of "double-extortion" tactics, which involve not only encrypting a victim's systems but also threatening to publicly disclose any allegedly stolen sensitive information if a ransom is not paid. The RansomHouse Namibia Defence Ministry cyberattack represents a serious challenge to the nation's digital security infrastructure.

NAM-CSIRT has taken immediate action, actively engaging in a comprehensive response effort. This includes coordinating technical support for the affected ministry, spearheading investigation activities to understand the full scope of the breach, and implementing remediation measures to contain and eradicate the threat. Furthermore, the team is conducting post-incident reviews to learn from the event and strengthen future defenses. These actions are being meticulously carried out in accordance with the established national incident management framework, as detailed in the National Cyber Security Incident Management Guidelines Namibia.

The ongoing response to the Ministry of Defence and Veterans Affairs cyber incident is firmly rooted in the National Cyber Security Incident Management Guidelines. These guidelines advocate for a coordinated, risk-based methodology in addressing cyber incidents, encompassing detection, containment, recovery, and continuous improvement. The overarching goal of this framework is to bolster the resilience of Namibia's critical information infrastructure and essential services against an ever-evolving array of digital threats. NAM-CSIRT, as Namibia's national cybersecurity coordination centre, plays a pivotal role in operationalizing these guidelines.

Emilia Nghikembua, who serves as both the Chief Executive Officer of Cran and the Head of NAM-CSIRT, underscored the universal vulnerability to cyber threats. She stated that this incident underscores that no organization, regardless of its size or mandate, is impervious to the evolving landscape of cyber threats. Nghikembua affirmed NAM-CSIRT's unwavering commitment to supporting the MODVA and all other affected stakeholders, ensuring a thorough investigation, effective recovery processes, and a concerted effort to strengthen cyber resilience across all government sectors and critical national infrastructure. This commitment highlights the importance of the Namibia Cyber Security Incident Response Team in national security.

In light of the recent RansomHouse Namibia Defence Ministry cyberattack, Cran and NAM-CSIRT are intensifying their encouragement for robust cybersecurity practices across the nation. They urge government institutions, operators of Namibia critical infrastructure cybersecurity, and private-sector entities to proactively maintain strong cybersecurity postures. Key recommendations include the implementation of comprehensive incident response plans, the regular conduct of security assessments to identify vulnerabilities, and, crucially, the prompt reporting of any significant cyber incidents directly to NAM-CSIRT. This emphasis on Cran cybersecurity reporting Namibia is vital for fostering national cyber resilience and enabling coordinated response efforts.

Nghikembua further articulated that the collective security of Namibia's entire digital ecosystem hinges on several critical factors: timely reporting of incidents, proactive information sharing among stakeholders, and continuous investment in cybersecurity preparedness. She issued a strong call to action, urging all organizations to reinforce their cyber defenses and to collaborate closely with NAM-CSIRT. This collaborative approach is essential for safeguarding the critical systems, sensitive data, and vital services upon which Namibian citizens rely daily, reinforcing the importance of a unified front against cyber adversaries.

This incident highlights the critical need for Namibian legal and compliance professionals to review their clients' cyber incident response plans, ensuring strict adherence to the National Cyber Security Incident Management Guidelines, particularly regarding timely reporting to NAM-CSIRT and managing potential data breach and 'double-extortion' risks.

Source: Original reporting via New Era