Ransomware Group: FUNKSEC

VICTIM NAME: barilga[.]gov[.]mn

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the FUNKSEC Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak associated with the website barilga.gov.mn pertains to the Барилгын хөгжлийн төв (Construction Development Center) located in Mongolia, which is tasked with the regulation and advancement of the construction sector in the nation. This page reveals that if the ransom is not paid, the stolen data will be made available for sale. Specifically, the price for the ransom is set at 1 million, while the resale price for the interested parties is noted to be 50,000. Such amounts reflect the severity of the breach faced by the organization, which is integral to the construction industry’s governance in Mongolia.

According to the extracted information, the attackers claim to have exfiltrated a range of sensitive materials, including various documents, spreadsheets, and internal reports dating from 2014 to 2025. This includes detailed information regarding payment plans and employee data, all of which could pose significant risk if distributed maliciously. The leak page also emphasizes the presence of numerous images, which likely depict either data excerpts or cataloged evidence of the breach, underscoring the attackers’ claims. The impact of such a leak could have serious implications for the affected parties within the construction sector, given the confidential nature of the compromised data.