Cyber-attack on Foreign Ministry visa register exposes risk for organised crime
A phishing hack has affected the Consular Services System of the Ministry of Foreign Affairs, compromising the visa register. The National Cybersecurity Agency confirmed an ongoing investigation.
Malware in Chilean consular system replicates every 10 minutes with no solution in sight
A cyber-attack has been affecting the Consular Services System (SAC) of Chile's Ministry of Foreign Affairs for the past two weeks, according to information obtained by the investigation unit at elmostrador.cl. The hack compromises the visa register, a database that groups of cybercriminals typically trade with transnational organised crime organisations.
The attack originated through phishing: an email directed at a member of the diplomatic corps was opened within the ministry, activating a "booby trap"—a hidden trap with malicious code embedded in an apparently ordinary file, such as a PDF—that allows system data to be accessed. Sources familiar with the case describe the hack as the most persistent and serious that the ministry has ever suffered.
The malware self-replicates and blocks any intervention
The seriousness of the incident lies in the fact that the malware automatically clones itself every ten minutes, which prevents it from being removed without reproducing again. The only available technical alternative would be to shut down the system completely to eradicate the "booby trap", but that option has been ruled out because it would leave more than one million Chileans abroad unable to access consular services.
As the virus spread through the system, security teams attempted to contain the attack without success. According to sources at the ministry, several officials have sought cooperation from international intelligence organisations in search of technologies that do not exist in the country, though so far the response has been, in the words of an internal source, "like talking to a brick wall".
The matter has been handled confidentially by the cybersecurity team of the Strategic Planning Department (Diplane), the General Secretariat for Foreign Policy (Segen), Minister Francisco Pérez Mackenna, the undersecretary and some cabinet officials. Ministry staff have not been warned about the breach, which increases the risk of the virus spreading to other systems.
Visa register, a frequent target for organised crime
The operation primarily affects the visa register, a type of access that hackers sell to organised crime groups that require false identities for movement. This type of access allows transnational gangs to create shell companies, traffic in persons, commit migration fraud, set up fictitious travel agencies, obtain residence visas for cartel members and launder money, amongst other crimes.
Although the origin of the attack has not been determined, it is suspected that it could come from eastern groups, such as Chinese mafia or a state actor, according to sources cited by elmostrador.cl.
Furthermore, internal sources indicate that ministry authorities have not fully grasped the severity of the problem, and that basic security protocols have been breached: officials continue to use personal mobile phones and to download or send documents via WhatsApp, instead of using government devices.
Foreign Ministry acknowledges forensic analysis; ANCI investigates and rules out fines for now
When contacted by elmostrador.cl, the Ministry of Foreign Affairs confirmed that "forensic analysis is being carried out aimed at assessing the incidents mentioned". The ministry added that cybersecurity is a maximum priority for the ministry and that its systems are monitored constantly to detect and prevent unauthorised access attempts.
"To deal with these threats, the ministry has prevention, detection and response capabilities for cybersecurity incidents, which are in constant updating and strengthening, with the aim of safeguarding institutional information and guaranteeing the operational continuity of its systems. Every incident is always reported through the corresponding government channels, in accordance with existing protocols", the ministry said.
The National Cybersecurity Agency (ANCI) confirmed to elmostrador.cl that it is carrying out an investigation into the breach. The agency clarified that no fines have been established, as these are only determined once the investigation is concluded. So far, ANCI suspects a DDoS-type attack and stated that it was not informed of the existence of a "booby trap" in the system.
Foreign Ministry under fire on multiple fronts
The Ministry of Foreign Affairs is facing this cybersecurity crisis in the midst of a period of institutional turbulence. The ministry has faced criticism during the past week over the nominations of actor Luis Gnecco as attaché in the United Kingdom and former Security Minister Trinidad Steitner as representative in Paraguay, appointments that have generated a series of questions about decisions made in the building located in the former Hotel Carrera.
The cyber-attack on the SAC adds a new dimension to the pressures facing the institution, with implications that go beyond diplomatic management and directly reach the information security of Chilean citizens abroad and the integrity of the national migration system.
Source: Google News CL — Crime