Ransomware Hits Colombian Justice Ministry Ahead of Presidential Transition: Detection, Response, and Hardening Guide

Colombia's Ministry of Justice and Law (MinJusticia) confirmed a ransomware-driven cyber incident just days before a presidential transition — the worst possible timing for a government handover, when institutional attention is divided, administrative credentials are being rotated, and operational continuity is already under strain. The attack is part of a sustained wave of ransomware and data-extortion activity against Latin American government institutions and critical infrastructure operators, a pattern that has intensified over the past 18 months and shows no sign of slowing in 2026.

For defenders, this incident matters far beyond Bogotá. Ministries of justice, interior ministries, courts, and electoral bodies worldwide run on the same architectural stack: aging on-premises Windows estates, sprawling Active Directory forests, under-patched virtualization clusters, and third-party managed service providers with elevated access. That is exactly the terrain ransomware operators — and the initial access brokers who sell into them — have industrialized. If your organization resembles that profile, treat this incident as a live-fire rehearsal for your own environment.

This post breaks down the attack pattern, the tradecraft you should expect, and provides deployable Sigma, KQL, and Velociraptor detections plus a hardening script.

Technical Analysis

What happened

According to reporting on the incident, attackers deployed encryption-based malware inside the Justice Ministry's environment, forcing the institution to take systems offline and disrupting services that underpin judicial and administrative functions. The timing — immediately ahead of a presidential transition — is consistent with a deliberate trend we have tracked across the region: operators time intrusions against government entities to coincide with political transitions, elections, and fiscal year-ends, when pressure to pay is maximal and incident response capacity is stretched thin.

This is not an isolated event. Colombia and its neighbors have absorbed repeated blows against government-linked organizations and critical infrastructure: judicial branches, healthcare providers, telecommunications operators, and managed service providers that serve as pivot points into dozens of downstream government tenants. The Colombian incident mirrors the 2023–2025 campaigns in which a compromise of a regional cloud/hosting provider cascaded into simultaneous encryption events across multiple government agencies — a supply-chain amplification pattern every public-sector CISO should plan against.

The typical attack chain (defender's perspective)

While full forensics from the MinJusticia incident have not been publicly released, government-sector ransomware intrusions in Latin America over the past two years follow a highly repeatable playbook. Your detection strategy should assume this chain:

1. Initial access — Phishing with malicious attachments or links, exploitation of exposed remote services (RDP, VPN concentrators, unpatched edge appliances), or valid accounts purchased from initial access brokers. In government environments with outsourced IT, compromised MSP credentials are a recurring entry vector.
2. Execution and persistence — Stagers and loaders launched via powershell.exe, wscript.exe, or rundll32.exe; persistence via scheduled tasks, services, and Run keys.
3. Defense evasion — Disabling endpoint protection using tools like bcdedit, tampering with Windows Defender via Set-MpPreference, killing backup agents, and — the single highest-fidelity pre-encryption signal — shadow copy deletion via vssadmin delete shadows /all /quiet or wmic shadowcopy delete.
4. Discovery and lateral movement — net group "Domain Admins", nltest /dclist:, BloodHound/SharpHound collection, then movement via SMB/admin shares, PsExec-style service creation, WinRM, or RDP using harvested credentials.
5. Staging and exfiltration — Data staged with rclone.exe or 7-Zip and pushed to MEGA or attacker-controlled cloud storage before encryption (double extortion).
6. Impact — Domain-wide encryption pushed via GPO, PsExec, or directly against ESXi/vCenter (esxcli vm process kill, then mass encryption of VMDK datastores) to maximize operational destruction.

Exploitation status and threat context

No specific CVE has been publicly tied to this intrusion, and we will not speculate on one. What is confirmed: the attack is a real, disruptive ransomware incident against a national ministry, and it sits within an active, ongoing campaign trend against Latin American government and critical infrastructure. Ransomware groups operating in the region — both Spanish-speaking crews and affiliates of global RaaS programs — have demonstrated they treat government transitions as targeting windows. Assume the TTPs above are in active use now against comparable organizations.

The key defensive lesson: in most of these intrusions, the encryption binary itself is the last observable. Every phase before it — staging, shadow deletion, Defender tampering, mass service creation — is detectable with commodity telemetry if you are actually watching for it.

Detection & Response

The detections below target the pre-encryption behaviors that give you a window to respond. Prioritize the shadow-copy deletion and Defender-tampering rules — in a decade of ransomware IR engagements, those two signals have preceded nearly every mass-encryption event we have responded to.

Sigma Rules

---
title: Ransomware Pre-Encryption - Shadow Copy Deletion
id: 3f9c2a71-8b4d-4e6a-9c15-2a7d1f8e3b90
status: experimental
description: Detects deletion of Volume Shadow Copies and boot recovery tampering, a near-universal precursor to ransomware encryption observed in government-sector intrusions including attacks on Latin American ministries.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.darkreading.com/cyberattacks-data-breaches/ransomware-hits-colombian-justice-ministry-presidential-transition
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
      - 'delete catalog'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup maintenance scripts; correlate with source host and user context
level: critical
---
title: Ransomware Defense Evasion - Windows Defender Tampering via PowerShell
id: 7c1e5b92-3d8f-4a2c-b6e4-9f1a3c5d7e28
status: experimental
description: Detects PowerShell-based tampering with Microsoft Defender real-time protection and exclusion paths, a common defense-evasion step before ransomware payload deployment in government network intrusions.
references:
  - https://attack.mitre.org/techniques/T1562.001/
  - https://www.darkreading.com/cyberattacks-data-breaches/ransomware-hits-colombian-justice-ministry-presidential-transition
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Set-MpPreference -DisableRealtimeMonitoring $true'
      - 'Add-MpPreference -ExclusionPath'
      - 'Set-MpPreference -DisableBehaviorMonitoring $true'
      - 'Set-MpPreference -DisableIOAVProtection $true'
      - '-DisableScriptScanning $true'
falsepositives:
  - Rare; some software deployment tooling adds exclusions — verify against change management records
level: high
---
title: Ransomware Lateral Movement - PsExec-Style Remote Service Execution
id: 9d4a6f13-2c7b-4e9a-a1d5-8b3f6c2e4a71
status: experimental
description: Detects remote service installation and execution patterns consistent with PsExec-style mass deployment used by ransomware operators to push encryptors across government domain infrastructure.
references:
  - https://attack.mitre.org/techniques/T1569.002/
  - https://attack.mitre.org/techniques/T1021.002/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
      - '\csexec.exe'
      - '\remcom.exe'
  filter_legit:
    CommandLine|contains:
      - '-accepteula'
  condition: selection and not filter_legit
falsepositives:
  - Enterprise software deployment platforms; baseline authorized admin tooling and alert on deviations
level: high

KQL Hunt (Microsoft Sentinel / Defender)

This query correlates the three highest-fidelity pre-encryption behaviors — shadow deletion, Defender tampering, and suspicious staging/archiving tools — on a single host within a 24-hour window. A host exhibiting two or more of these behaviors in sequence should trigger immediate containment.

let lookback = 24h;
let SuspiciousStaging = dynamic(["rclone.exe", "7z.exe", "7za.exe", "winrar.exe", "megasync.exe", "psexec.exe"]);
let PreEncryptionEvents = union
    (DeviceProcessEvents
    | where TimeGenerated >= ago(lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "resize shadowstorage", "recoveryenabled no", "ignoreallfailures", "delete catalog")
    | project TimeGenerated, DeviceName, AccountName, Signal="ShadowCopyDeletion", ProcessCommandLine),
    (DeviceProcessEvents
    | where TimeGenerated >= ago(lookback)
    | where ProcessCommandLine has_any ("DisableRealtimeMonitoring", "ExclusionPath", "DisableBehaviorMonitoring", "DisableIOAVProtection")
    | project TimeGenerated, DeviceName, AccountName, Signal="DefenderTampering", ProcessCommandLine),
    (DeviceProcessEvents
    | where TimeGenerated >= ago(lookback)
    | where FileName in~ (SuspiciousStaging)
    | project TimeGenerated, DeviceName, AccountName, Signal="StagingToolExecution", ProcessCommandLine);
PreEncryptionEvents
| summarize Signals = make_set(Signal), SignalCount = dcount(Signal), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Commands = make_set(ProcessCommandLine) by DeviceName, AccountName
| where SignalCount >= 2
| order by SignalCount desc;

If you ingest firewall/edge logs into CommonSecurityLog, add a companion hunt for large outbound transfers to consumer cloud storage (MEGA, Dropbox, anonfile-style hosts) from server VLANs — a hallmark of pre-encryption exfiltration:

CommonSecurityLog
| where TimeGenerated >= ago(24h)
| where DeviceAction =~ "Allow" or DeviceAction =~ "allow"
| where RequestURL has_any ("mega.nz", "mega.co.nz", "transfer.sh", "gofile.io", "file.io", "dropbox.com")
| summarize TotalBytesOut = sum(tolong(SentBytes)), Destinations = make_set(RequestURL) by SourceIP, DestinationHostName
| where TotalBytesOut > 104857600
| order by TotalBytesOut desc;

Velociraptor VQL Hunt

Deploy this hunt across your Windows fleet to surface pre-encryption activity and staging tools. In an active IR, run it against the ministry-agency-style server estate first — domain controllers, file servers, and application hosts.

-- Hunt for ransomware pre-encryption activity: shadow deletion, Defender tampering, staging tools
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|resize shadowstorage|recoveryenabled no|DisableRealtimeMonitoring|ExclusionPath|DisableBehaviorMonitoring)'
   OR Name =~ '(?i)(rclone|7z|7za|psexec|megasync|winrar)\.exe'

For persistence and staging artifact triage on suspect hosts:

-- Enumerate recently created scheduled tasks and services (common ransomware persistence/deployment mechanisms)
SELECT Name, FullPath, CommandLine, Mtime
FROM glob(globs='C:/Windows/System32/Tasks/**')
WHERE Mtime > timestamp(epoch=now() - 604800)
   OR CommandLine =~ '(?i)(vssadmin|bcdedit|psexec|\\users\\public|\\programdata\\)'

Verification and Hardening Script

Run this on Windows servers and workstations to verify the controls that most often decide whether a ransomware intrusion becomes an encryption event: shadow copies enabled and protected, Defender tamper protection on, and SMBv1 disabled.

# Verify Tamper Protection and Defender status
$mp = Get-MpComputerStatus
Write-Output "RealTimeProtection: $($mp.RealTimeProtectionEnabled)"
Write-Output "TamperProtection: $($mp.IsTamperProtected)"
Write-Output "BehaviorMonitoring: $($mp.BehaviorMonitorEnabled)"

# Ensure shadow copies are enabled on all fixed volumes (client OS)
Get-CimInstance -ClassName Win32_ShadowCopy | Select-Object VolumeName, InstallDate
vssadmin list shadows

# Disable SMBv1 (legacy lateral movement and wormable protocol)
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol | Select-Object State
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart -ErrorAction SilentlyContinue
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# Block PsExec-style remote service abuse: audit ADMIN$ writes
auditpol /set /subcategory:"Detailed File Share" /success:enable /failure:enable

# Restrict PowerShell remoting to approved admin hosts (run on servers)
# Enable-PSSessionConfiguration -Name "Microsoft.PowerShell" -SecurityDescriptorSddl "O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-21-<your-admin-group-SID>)S:P(AU;FA;GA;;;WD)"

# Verify LAPS is deployed so local admin passwords are unique per host (kills pass-the-hash spray)
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS" -ErrorAction SilentlyContinue

# Confirm backups are offline/immutable - list VSS protection and backup agent presence
Get-Service | Where-Object { $_.DisplayName -match 'Veeam|Commvault|Veritas|Azure Backup|Rubrik' } | Select-Object Name, Status, StartType

Remediation

There is no single patch for this incident — the remediation is architectural. Based on the tradecraft pattern behind government-sector ransomware in Latin America, prioritize the following:

1. If you are responding to an active event now: Isolate affected segments at the switch/firewall level (do not just power off — preserve volatile memory for forensics), disable compromised accounts domain-wide, force a krbtgt double-reset, and engage IR support before any recovery attempt. Recover domain controllers from known-clean, pre-compromise backups only after scoping is complete.
2. Kill the entry vectors. Enforce phishing-resistant MFA (FIDO2/passkeys) on all remote access — VPN, RDP gateways, webmail — and on all privileged accounts. Government intrusions in the region repeatedly trace back to exposed RDP and single-factor VPNs. Block direct internet RDP (3389) entirely at the perimeter.
3. Segment ruthlessly. Ministry-scale flat networks are why a single workstation compromise becomes a national incident. Isolate server VLANs, deny workstation-to-workstation SMB/RDP/WinRM, and place backup infrastructure in a separate security zone with its own credentials.
4. Make backups survivable. Maintain at least one immutable or physically offline copy (object-lock/WORM storage or air-gapped). Attackers routinely delete Veeam/Commvault repositories before encrypting. Test restoration quarterly — an untested backup is a hypothesis, not a control.
5. Protect the virtualization tier. If you run VMware ESXi, patch hypervisors on the same cadence as critical CVEs, isolate management interfaces, disable SSH on hosts when not in use, and lock down vCenter with MFA. Mass datastore encryption is how these groups achieve ministry-scale impact in hours.
6. Deploy the detections above and test them. Run a purple-team exercise that simulates shadow-copy deletion and Defender tampering and verify your SOC actually pages on it. Detection that has never been tested is decoration.
7. Plan for the transition window. If your organization faces a leadership transition, election cycle, or major fiscal event, raise your alert posture 30 days before and after: tighten change control, pre-stage IR retainers, and brief executives on the decision tree for a ransom/extortion event before it happens.
8. Audit third-party and MSP access. The regional pattern of compromise-through-hosting-provider is unambiguous. Inventory every external entity with administrative reach into your environment, enforce MFA on their access, and contractually require incident notification SLAs.

Conclusion

The MinJusticia attack is not an anomaly — it is the current baseline for government-sector risk in Latin America, and a preview of what awaits any institution running legacy infrastructure through a political transition window. The organizations that survive these events with minimal damage are not the ones with the biggest budgets; they are the ones that detect shadow-copy deletion at 2 a.m., contain a single host before lateral movement, and restore from backups the attackers could not reach. Deploy the detections, test them, and rehearse the response. The next transition window is already on someone's targeting calendar.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub