CyphrQ
Menu

Costa Rica Ransomware Attack 2022: Conti and the National Emergency

How Conti's April 2022 ransomware attack hit Costa Rica's customs and tax systems, why a national emergency followed, and what to check.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Incident: April 20229 min read

What was the Costa Rica ransomware attack? In April 2022, the Conti ransomware group attacked the Government of Costa Rica. The US State Department says the attack badly hit the country's foreign trade by disrupting its customs and tax platforms (US State Department). The incoming government then declared a national emergency covering the entire public sector.

Each fact below is tied to an official source, and gaps are marked. Spanish quotations are our translation. More regional cases are on the Latin America breaches page.

Case file

Field Value
Organisation Government of Costa Rica (public sector). The State Department names the customs and tax platforms as disrupted (US State Department)
Region Costa Rica
Breach date April 2022 (US State Department)
Disclosed Not stated in official sources read. Earliest official statement we read: US State Department, 6 May 2022
People affected Not stated in official sources read
Data types Not stated in official sources read
Penalty/action National emergency across the whole public sector, Executive Decree No. 43542-MP-MICITT (MICITT). US reward offers of up to US$10 million and up to US$5 million over Conti (US State Department)
Regulator No regulator action found in official sources read. Lead response body: CSIRT-CR, within the science and technology ministry, MICITT (MICITT)
Status Not stated in official sources read: we found no official notice on whether or when the emergency ended

What happened in the Costa Rica ransomware attack, and when?

The clearest official account comes from Washington, not San José. On 6 May 2022, the US State Department announced reward offers over Conti. It said that in April 2022 the group carried out a ransomware incident against the Government of Costa Rica that seriously affected foreign trade by disrupting customs and tax platforms (US State Department).

In plain terms, ransomware locks an organisation's files and demands payment to unlock them. Conti also stole data and threatened to publish it.

Costa Rica's own account sits in its National Cybersecurity Strategy 2023-2027, published by MICITT. It refers to "the cyberattacks of the present year (2022)", in the plural, and to cybercrimes that "have affected the structure of the information systems of various institutions" (MICITT, ENC 2023-2027, pp. 5-6). It does not name Conti, list the institutions, or give a count.

The first official reaction came from the outgoing government. It issued Directive No. 133-MP-MICITT, telling central government bodies to report cyber incidents to CSIRT-CR and to put security measures in place (same source).

Not confirmed here. The finance ministry's own statements sit on a server our tools could not reach. The ransom amount appears only in press reports, so we leave it out.

Why did Costa Rica declare a national emergency over the Conti ransomware attack?

The government that took office in 2022 issued Executive Decree No. 43542-MP-MICITT. MICITT says it declared "a state of national emergency in the entire public sector of the Costa Rican State", because of the cybercrimes hitting institutions' systems (MICITT, p. 14).

The purpose was practical. In MICITT's words, the decree was meant "to facilitate the availability of resources and the administrative acts necessary to attend to the emergency". In plain terms: money and decisions could move faster.

Three follow-ups appear in the strategy (same source, p. 14):

  1. A General Emergency Plan (PGE), issued in June under the decree and Law No. 8488. It explains the cause, estimates damage and losses, and sets out actions and resources. The strategy does not publish those estimates.
  2. A diagnostic report, MICITT-DGD-INF-099-2022, cited in the plan, with findings on public-sector cybersecurity and technology governance.
  3. A national attack protocol, drafted for "a threat of an attack on national cybersecurity" and, when the strategy was written, under review by the emergency commission (CNE), CSIRT-CR, the state utility ICE and MICITT's telecoms vice-ministry.

Has the emergency ended? The strategy sets out no roadmap for ending it, and we found no official notice of its end. The emergency commission's website blocked automated access, and we didn't try to get around that.

What weaknesses does Costa Rica's own strategy admit?

  • A government CSIRT, not a national one. CSIRT-CR was created by decree in 2012 but began formal operations only in 2018. MICITT concludes its legal mandate is that of a government CSIRT, "and not of a national CSIRT" (MICITT, p. 12).
  • An expired strategy nobody measured. The 2017 strategy ran out in 2021. A 2021 review found no metrics had been collected to judge its eight objectives, and that it was not widely communicated (p. 13).
  • A falling ranking. On the National Cyber Security Index, Costa Rica was 53rd in 2020 and fifth in the Americas. By 2022 it had dropped 22 places, to 75th (p. 7).

None of these caused the attack on its own. Together, they describe a state that had a response team but not the reach or measurement to run defence across every ministry.

How has Costa Rica responded since the Conti attack?

The 2023-2027 strategy is the main official response we could read. Its commitments map neatly onto what went wrong (MICITT):

Commitment Line of action
A National Cybersecurity Agency able to issue binding guidelines to public bodies 1.1.3
A dedicated cybersecurity budget line in government bodies 1.2.3
A national SOC plus sector SOCs (government, health, transport, finance, education, energy and telecoms, security), operating 24/7 3.3.2
Regular incident exercises for critical infrastructure operators 3.5.1
Contingency and recovery plans for each piece of critical infrastructure 3.6.1, 3.6.2
Clearer legal mandate for CSIRT-CR 3.8.7
A mandatory annual MICITT cybersecurity course in public institutions 4.1.3

A SOC (security operations centre) is the team that watches systems around the clock and acts on alerts. These are plans; we found no official report on which have been delivered.

Who was behind the Costa Rica attack, and how does Conti operate?

The US government attributes the attack to Conti. The State Department cites an FBI estimate that, as of January 2022, Conti-linked attacks had more than 1,000 victims and payouts above US$150 million, making it the costliest ransomware strain ever documented (US State Department).

The joint US advisory on Conti, AA21-265A, adds detail. Its February 2022 update says reported Conti attacks on US and international organisations had "risen to more than 1000" (CISA, FBI, NSA, USSS). It describes a twist on the usual affiliate model: Conti's developers likely paid the people deploying it "a wage rather than a percentage" of the proceeds.

For how ransomware attacks unfold in general, from first access to the ransom note, see our ransomware explainer.

Going deeper: for security and IT teams

Threat model. Conti was a financially motivated criminal operation. It targeted organisations that could not tolerate downtime, encrypted servers and workstations, and threatened to leak stolen files. CISA calls this "double extortion" (AA21-265A). A government fits that profile at its most extreme: when customs and tax systems stop, trade stops with them.

What is not known. No official source we read describes how Conti got into Costa Rica's systems. The mapping below is Conti's documented playbook from the US advisory and MITRE's Conti entry. It shows what defenders should expect from this group. It is not a reconstruction of the Costa Rican intrusion.

Conti's documented chain, mapped to ATT&CK. Technique IDs below come from Table 1 of AA21-265A and from MITRE's software page for Conti, S0575. We opened both; we did not open each technique page.

Stage Technique What the source says
Initial access T1078 Valid Accounts Access through stolen Remote Desktop Protocol (RDP) credentials (CISA)
Initial access T1566.001, T1566.002 Spearphishing attachment and link Delivery through TrickBot via malicious attachments or links (CISA)
Persistence T1133 External Remote Services VPNs, Citrix and similar remote gateways (CISA)
Discovery T1135 Network Share Discovery Enumerates SMB shares using NetShareEnum() (MITRE S0575)
Lateral movement T1021.002 SMB/Windows Admin Shares Spreads over SMB, potentially compromising an entire network (MITRE S0575)
Impact T1489 Service Stop Stops up to 146 Windows services tied to security, backup, database and email (CISA, MITRE S0575)
Impact T1490 Inhibit System Recovery Deletes Volume Shadow Copies with vssadmin (CISA, MITRE S0575)
Impact T1486 Data Encrypted for Impact A different AES-256 key per file (CISA, MITRE S0575)

CISA also says that, according to a leaked Conti playbook, the actors exploited unpatched flaws to escalate and move laterally. The flaws listed are the 2017 SMB 1.0 server vulnerabilities (MS17-010), PrintNightmare (CVE-2021-34527) and Zerologon (CVE-2020-1472). Data left through the open-source tool Rclone.

Controls that break the chain, in CISA's wording where quoted (AA21-265A):

  • Remote access. "Require multifactor authentication to remotely access networks from external sources." If RDP is operationally necessary, "restrict the originating sources and require multifactor authentication."
  • Segmentation. Robust segmentation "between networks and functions to reduce the spread of the ransomware". In a government, that means one ministry's breach should not reach another's servers.
  • Patching. Close MS17-010, CVE-2021-34527 and CVE-2020-1472 everywhere they apply, domain controllers first. CISA suggests centralised patch management.
  • Execution and tools. Application allowlisting, macros disabled in emailed Office files, and removal of remote monitoring or remote desktop software that daily work doesn't need. Conti used such legitimate tools as backdoors.
  • Accounts. Audit admin accounts under least privilege and separation of duties, and check logs so new accounts belong to real users.
  • Recovery. Before restoring, scan backups for malware. Keep copies the domain admin account cannot delete, since Conti targets backup services and shadow copies.

Detection signals drawn from the behaviours above: vssadmin deleting shadow copies; bursts of net stop against security or backup services; Rclone running on servers; new remote-management software; and admin accounts nobody requested.

What to verify or ask.

  • Can any internet-facing RDP, VPN or Citrix gateway be used with a password alone? Test from outside.
  • Can you prove, from scan results rather than tickets, that domain controllers are patched for Zerologon?
  • Does every agency report incidents to one central team within a set time, as Costa Rica's Directive 133 began to require?

What should a public body check after the Costa Rica attack?

  1. List the systems that, if offline for a week, would stop revenue collection, trade or payments.
  2. Confirm MFA on every external route into them, including contractor and vendor access, and segment them from the rest of government.
  3. Write and rehearse a plan for running each of those services manually or on a fallback system.
  4. Agree a single reporting line to the national or government CSIRT, with a deadline.
  5. Decide in advance who can declare an emergency and release funds, so the response doesn't wait on paperwork.

Learn more

Key takeaways

  • The Costa Rica ransomware attack began in April 2022. The US government attributes it to Conti and says it disrupted customs and tax platforms, seriously affecting foreign trade.
  • Costa Rica declared a national emergency across its whole public sector by Executive Decree No. 43542-MP-MICITT, to speed up resources and administrative decisions.
  • The number of people affected, the data taken, the intrusion path and the end date of the emergency are not stated in the official sources we could read.
  • Costa Rica's own strategy admits gaps and promises a national cyber agency, a 24/7 national SOC with sector SOCs, and contingency plans for critical infrastructure.
  • Against Conti's documented playbook, the controls that matter most are MFA on remote access, segmentation, patching of known flaws and backups attackers can't delete.

Sources