RansomHouse picks a fight with Namibia's defense establishment

Namibia's Computer Security Incident Response Team (NAM-CSIRT) has confirmed unauthorized network activity in the country's defense ministry, linking it to the RansomHouse cybercrime group. RansomHouse explicitly named the Namibian Defence Force (NDF) as its victim on September 16, although the domain listed belonged to the Ministry of Defence and Veterans Affairs (MODVA).

The group demanded that the NDF contact them to prevent confidential data leaks, stating it was waiting for the target for some time. While the leak site treated the target as a company with $434 million in annual revenue, NAM-CSIRT later confirmed the incident within MODVA's network. NAM-CSIRT is actively coordinating technical support, investigation, remediation, and post-incident review processes as per the National Cyber Security Incident Management guidelines.

Chief Executive Emilia Nghikembua of the Communications Regulatory Authority of Namibia urged organizations across the country to report cyberattacks promptly to build a fuller picture of the threat landscape. RansomHouse, active since 2021, is known for double extortion tactics but remains less active than some other prominent ransomware groups.