investigates alleged spear-phishing attack on gov’t network, questions firm’s motivations

THE National Data Management Authority’s (NDMA) Cybersecurity Division has refuted claims made by a cybersecurity firm regarding a successful cyber-espionage malware attack on the Government of Guyana’s network.

The cybersecurity firm alleged that a government agency in Guyana fell victim to a spear-phishing campaign in February, 2023. However, after conducting thorough investigations, the NDMA stated that the cybersecurity firm had exaggerated the threat.

The initial claim by the cybersecurity firm, which surfaced on October 5, 2023, prompted the NDMA to deploy its team of cybersecurity analysts and specialists to assess the situation.

NDMA General Manager, Christopher Deen, emphasized the government’s commitment to cybersecurity and said, “We have launched extensive investigations both within and outside the government’s network to determine the validity of this report. Based on the information currently available, a spear-phishing attempt was made against a government ministry, but our security systems intercepted and neutralized the threat.”

Mr. Deen also highlighted the ongoing efforts of NDMA in countering cyber threats, revealing that in the first quarter of 2023, the NDMA detected and mitigated 442 malware attacks at government agencies.

While investigations are ongoing, the NDMA has reached out to the cybersecurity firm that made the claims to obtain additional information, verify the data shared, and identify the firm’s sources. However, as of now, the cybersecurity firm has not responded to the NDMA’s request for further information.

NDMA has also raised questions about the motivations and ethics of the cybersecurity firm in disclosing sensitive information without stakeholder consultation. It is unusual for cybersecurity professionals to single out specific incidents without explicit permission from the affected party.

The incident serves as a reminder of the prevalence of phishing attacks in the digital world.

Forbes, in a June 2023 online article reported over five hundred million ( 500,000,000) phishing attacks worldwide in 2022, highlighting the need for robust cybersecurity measures.

The NDMA noted that the agency remains committed to promoting safe cybersecurity practices within government ministries and agencies. They operate a 24/7 security operations centre and the Guyana National Computer Incident Response Team (CIRT) to provide technical support and incident handling. Additionally, the NDMA conducts cybersecurity awareness training initiatives and programmes.

In line with the global theme of Cybersecurity Awareness Month in October, the NDMA will facilitate training sessions across the country to empower citizens with cybersecurity skills and knowledge. The initiative aims to educate individuals on safe online practices, recognizing and mitigating cyber threats, and ensuring online safety.

The NDMA urges the public to stay vigilant and follow best practices to protect against cyber threats while emphasizing the importance of responsible reporting and handling of cybersecurity incidents.