{
	"id": "37ce41b2-0617-456f-9d27-5cc20e220ccf",
	"created_at": "2026-04-06T00:06:11.305545Z",
	"updated_at": "2026-04-10T13:11:35.378089Z",
	"deleted_at": null,
	"sha1_hash": "b7693434f25eb3556db26c3305dfe2cd403487d0",
	"title": "Ransomware gang threatens to ‘overthrow’ new Costa Rica government, raises demand to $20 million",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 79230,
	"plain_text": "Ransomware gang threatens to ‘overthrow’ new Costa Rica\r\ngovernment, raises demand to $20 million\r\nBy Jonathan Greig\r\nPublished: 2023-01-12 · Archived: 2026-04-05 18:43:20 UTC\r\nThe ransomware group behind an attack on several Costa Rican government ministries levied several violent\r\nwarnings against the country this weekend, raising the ransom demand to $20 million and threatening to\r\n“overthrow” the government of new President Rodrigo Chaves. \r\nIn two messages posted to their leak site on Saturday, the Conti ransomware group – which has already leaked\r\n97% of the 670 GB they stole from their attacks – claimed the U.S. government was “sacrificing” Costa Rica and\r\nthat the country's government should pay for the decryption keys to unlock their systems.\r\nCosta Rica’s new government took office last week and immediately declared a state of emergency after refusing\r\nto pay the initial $10 million ransom issued by Conti. The country has received assistance from officials in the\r\nU.S., Israel and other countries. The U.S. put a $10 million bounty out for anyone connected to Conti after the\r\nattack on Costa Rica.\r\n“Why not just buy a key? I do not know if there have been cases of entering an emergency situation in the country\r\ndue to a cyber attack? In a week we will delete the decryption keys for Costa Rica,” the group threatened. \r\n“I appeal to every resident of Costa Rica, go to your government and organize rallies so that they would pay us as\r\nsoon as possible. If your current government cannot stabilize the situation? Maybe its worth changing it?”\r\n#Conti's latest posts re: Costa Rica state they are 'determined to overthrow the government by means of\r\na cyber attack,' have increased the ransom to $20 million and will delete the decryption key in 7 days.\r\npic.twitter.com/MQ24KSAjwf\r\n— Brett Callow (@BrettCallow) May 14, 2022\r\nIn another message, the group called U.S. President Joe Biden a “terrorist” and said it was raising the ransom\r\nprice to $20 million. The group also implied that it would begin calling government officials to demand the\r\nransom. \r\n“Just pay before it's too late, your country was destroyed by 2 people, we are determined to overthrow the\r\ngovernment by means of a cyberattack, we have already shown you all the strength and power, you have\r\nintroduced an emergency,” the group added. \r\nMore than three weeks after the attack began, the country is still facing significant struggles, particularly because\r\nof the damage done to the Finance Ministry. \r\nhttps://therecord.media/ransomware-gang-threatens-to-overthrow-new-costa-rica-government-raises-demand-to-20-million/\r\nPage 1 of 3\n\nThe country was forced to tell residents last week that taxes need to be calculated by hand and paid in person at\r\nlocal banks, as opposed to the digital system the country has previously used. \r\n¡Atención contribuyentes! Pago de impuestos del próximo lunes deberá calcularse a mano y cancelarse\r\nen bancos https://t.co/ohqdohuY3d #NM935 pic.twitter.com/86g8fwEanx\r\n— Noticias Monumental (@MonumentalCR) May 13, 2022\r\nThe attack crippled the country’s customs and taxes platforms alongside several other government agencies, even\r\nbringing down one Costa Rican town’s energy supplier. The country’s treasury department has been unable to\r\noperate any of its digital services since the attack began, making it nearly impossible for paperwork, signatures\r\nand stamps required by law to be processed.\r\nOrganizations affected by the attack include:\r\nThe Finance Ministry\r\nThe Ministry of Science, Innovation, Technology, and Telecommunications\r\nThe Labor and Social Security Ministry\r\nThe Social Development and Family Allowances Fund\r\nThe National Meteorological Institute\r\nThe Costa Rican Social Security Fund\r\nThe Interuniversity Headquarters of Alajuela\r\nNo previous article\r\nNo new articles\r\nhttps://therecord.media/ransomware-gang-threatens-to-overthrow-new-costa-rica-government-raises-demand-to-20-million/\r\nPage 2 of 3\n\nJonathan Greig\r\nis a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since\r\n2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia.\r\nHe previously covered cybersecurity at ZDNet and TechRepublic.\r\nSource: https://therecord.media/ransomware-gang-threatens-to-overthrow-new-costa-rica-government-raises-demand-to-20-million/\r\nhttps://therecord.media/ransomware-gang-threatens-to-overthrow-new-costa-rica-government-raises-demand-to-20-million/\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://therecord.media/ransomware-gang-threatens-to-overthrow-new-costa-rica-government-raises-demand-to-20-million/"
	],
	"report_names": [
		"ransomware-gang-threatens-to-overthrow-new-costa-rica-government-raises-demand-to-20-million"
	],
	"threat_actors": [],
	"ts_created_at": 1775433971,
	"ts_updated_at": 1775826695,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/b7693434f25eb3556db26c3305dfe2cd403487d0.pdf",
		"text": "https://archive.orkl.eu/b7693434f25eb3556db26c3305dfe2cd403487d0.txt",
		"img": "https://archive.orkl.eu/b7693434f25eb3556db26c3305dfe2cd403487d0.jpg"
	}
}