{ "id": "468a1664-9757-4580-932c-055902d7e08b", "created_at": "2026-04-06T00:15:57.377338Z", "updated_at": "2026-04-10T03:21:37.444698Z", "deleted_at": null, "sha1_hash": "f9c24de482950994068eba447f1a371cf40615bd", "title": "Netwalker ransomware hits Argentinian government, demands $4 million", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 2803146, "plain_text": "Netwalker ransomware hits Argentinian government, demands $4\r\nmillion\r\nBy Lawrence Abrams\r\nPublished: 2020-09-06 · Archived: 2026-04-05 18:10:53 UTC\r\nArgentina's official immigration agency, Dirección Nacional de Migraciones, suffered a Netwalker ransomware attack that\r\ntemporarily halted border crossing into and out of the country.\r\nWhile ransomware attacks against cities and local agencies have become all too common, this may be a first known attack\r\nagainst a federal agency that has interrupted a country's operations.\r\nAccording to a criminal complaint published by Argentina's cybercrime agency, Unidad Fiscal Especializada en\r\nCiberdelincuencia, the government first learned of the ransomware attack after receiving numerous tech support calls from\r\ncheckpoints at approximately 7 AM on August 27th.\r\nhttps://www.bleepingcomputer.com/news/security/netwalker-ransomware-hits-argentinian-government-demands-4-million/\r\nPage 1 of 5\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/netwalker-ransomware-hits-argentinian-government-demands-4-million/\r\nPage 2 of 5\n\nVisit Advertiser websiteGO TO PAGE\r\n\"Being approximately 7 a.m. of the day indicated in the paragraph above, the Directorate of Technology and\r\nCommunications under the Directorate General Information Systems and Technologies of this Organization received\r\nnumerous calls from various checkpoints requesting technical support.\"\r\n\"This realized that it was not an ordinary situation, so it was evaluated the situation of the infrastructure of the Central Data\r\nCenter and Servers Distributed, noting activity of a virus that had affected the systems MS Windows based files (ADAD\r\nSYSVOL and SYSTEM CENTER DPM mainly) and Microsoft Office files (Word, Excel, etc.) existing in users' jobs and\r\nshared folders,\" a translation of the complaint stated.\r\nTo prevent the ransomware from infecting further devices, the computer networks used by the immigration offices and\r\ncontrol posts were shut down.\r\nAccording to Argentinian news site Infobae, this led to a temporary suspension of border crossings for four hours while the\r\nservers were brought back online.\r\n\"The Comprehensive Migration Capture System (SICaM) that operates in international crossings was particularly affected,\r\nwhich caused delays in entry and exit to the national territory,\" the National Directorate of Migration (DNM) stated.\r\nGovernment sources told Infobae that \"they will not negotiate with hackers and neither they are too concerned with getting\r\nthat data back.\"\r\nIf you have first-hand information about this attack or know of other unreported cyberattacks, you can confidentially contact\r\nus on Signal at +16469613731.\r\nNetwalker demands a $4 million ransom\r\nWhen the Netwalker performs a ransomware attack, ransom notes will be left on devices that have been encrypted.\r\nThese ransom notes contain links to a dark web payment site that contains information on how to purchase a decryptor, the\r\nransom amount, and information about any unencrypted files that were stolen during the attack.\r\nFrom a Netwalker Tor payment page shared with BleepingComputer, we have learned that the ransomware actors initially\r\ndemanded a $2 million ransom.\r\nAfter seven days passed, the ransom increased to $4 million, or approximately 355 bitcoins, as shown below in the image of\r\nDirección Nacional de Migraciones's ransom page.\r\nhttps://www.bleepingcomputer.com/news/security/netwalker-ransomware-hits-argentinian-government-demands-4-million/\r\nPage 3 of 5\n\nThis Tor site also includes a 'Stolen Data' page that displays a screenshot of data stolen from \"Migraciones Argentina\" during\r\nthis attack.\r\nDue to this leaked data's potentially sensitive nature, BleepingComputer has decided not to post the data leak screenshots.\r\nhttps://www.bleepingcomputer.com/news/security/netwalker-ransomware-hits-argentinian-government-demands-4-million/\r\nPage 4 of 5\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/netwalker-ransomware-hits-argentinian-government-demands-4-million/\r\nhttps://www.bleepingcomputer.com/news/security/netwalker-ransomware-hits-argentinian-government-demands-4-million/\r\nPage 5 of 5\n\n https://www.bleepingcomputer.com/news/security/netwalker-ransomware-hits-argentinian-government-demands-4-million/ \nThis Tor site also includes a 'Stolen Data' page that displays a screenshot of data stolen from \"Migraciones Argentina\" during\nthis attack. \nDue to this leaked data's potentially sensitive nature, BleepingComputer has decided not to post the data leak screenshots.\n Page 4 of 5", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://www.bleepingcomputer.com/news/security/netwalker-ransomware-hits-argentinian-government-demands-4-million/" ], "report_names": [ "netwalker-ransomware-hits-argentinian-government-demands-4-million" ], "threat_actors": [], "ts_created_at": 1775434557, "ts_updated_at": 1775791297, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/f9c24de482950994068eba447f1a371cf40615bd.pdf", "text": "https://archive.orkl.eu/f9c24de482950994068eba447f1a371cf40615bd.txt", "img": "https://archive.orkl.eu/f9c24de482950994068eba447f1a371cf40615bd.jpg" } }