December 12, 2024 – The Funksec ransomware gang has identified two Australian entities, WACER and the Fresh Produce Safety Centre Australia & New Zealand, as victims on its darknet leak site, revealing a small volume of allegedly stolen data.
WACER, a commercial cleaning supplier based in Western Australia, and the University of Sydney-affiliated Fresh Produce Safety Centre were listed by the gang, which claimed to have breached their databases. However, the data leaked appears to consist mainly of information scraped from the companies’ websites, totaling less than 20 megabytes and containing little that is not already publicly available.
Funksec is a relatively new ransomware operation that emerged earlier this month, having posted its first victim on December 4, 2024. The gang operates as a for-profit ransomware-as-a-service model and is reportedly attempting to extort $10,000 from a Mexican web hosting service. Funksec has expressed politically motivated intentions, specifically targeting the United States, which it accuses of undermining the Middle East’s stability.
The gang’s ransomware, dubbed FunkLocker, is described as a multi-threaded malware capable of file encryption and manipulation. Funksec has indicated that its ransom notes are designed to induce psychological pressure, often employing threatening language to compel victims to pay quickly to regain access to their files. Additionally, the group has been known to utilize deceptive recovery tactics to mislead victims into believing that payment will lead to successful decryption.
While the current leaks involving Australian organizations may seem relatively harmless, they highlight Funksec’s technical capabilities, including the development of its own ransomware and distributed denial-of-service (DDoS) tools. The gang has accumulated a list of victims since its inception, suggesting a potential for more severe attacks in the future.
The emergence of Funksec underscores the ongoing challenges organizations face in cybersecurity, particularly from sophisticated and politically motivated cybercriminal groups.
