Skip to main content
Darkfield

Ransomware victim disclosure

← All victims

Guatemala Ministry of National Defence – Military Intelligence Directorate (DIEMDN)

listed as Guatemala Military Intelligence Directorate · Claimed by Cyclops · listed 3 years ago

36m
Age
since listed · data leaked

Status timeline

  1. ListedJul 1, 2023
  2. Data leakeddate unknown

At a glance

Group
Cyclops
Status
Data leaked
Country
Guatemala
Sector
Government
Listed on leak site
Jul 1, 2023

About the victim

AI dossier — public-source company profile

The Guatemala Ministry of National Defence (Ministerio de la Defensa Nacional) is the Guatemalan government agency responsible for the budget, training, and policy of the country's armed forces, comprising the Army, Navy, Air Force, and Presidential Honor Guard. The Military Intelligence Directorate (DIEMDN – Dirección de Inteligencia del Estado Mayor de la Defensa Nacional) is the military intelligence arm operating under the Ministry. It is headquartered in Guatemala City.

Industry
Defence & Military Intelligence
Address
Guatemala City, Guatemala

Attack summary

Severity: critical — The victim is a national military intelligence directorate; exfiltration of intelligence files from a defence ministry constitutes a critical national-security exposure involving potentially classified government and defence data.

The Cyclops ransomware group claims to have exfiltrated data from the Guatemalan Military Intelligence Directorate (DIEMDN), publishing a download link to an archive (diemdn_mil_gt.zip) hosted on AnonFiles as proof of the breach; no ransom demand or encryption claim is stated.

critical

Data the group says was taken

AI dossier — extracted from the leak post
  • Military intelligence directorate files (diemdn_mil_gt.zip)

The group's post references roughly 1 proof file.

What the group claims

The Guatemalan Armed Forces (Fuerzas Armadas de Guatemala) consists of the National Army of Guatemala (Ejercito Nacional de Guatemala, ENG), the Guatemalan National Defense Navy (Marina de la Defensa Nacional, includes Marines), the Guatemalan Air Force (Fuerza Aerea Guatemalteca, FAG), and the Presidential Honor Guard (Guardia de Honor Presidencial).The Ministry of National Defence is the agency of the Guatemalan government responsible for the budget, training and policy of the armed forces. Based in Guatemala City, the Defence Ministry is heavily guarded, and the President of Guatemala frequently visits. As of 2017 the Minister of National Defence is Major General Luis Miguel Ralda Moreno.The Minister of Defense is responsible for policy. Day-to-day operations are the responsibility of the military chief of staff and the national defense staff.Data:===========https://anonfiles.com/F9pbi8zdzb/diemdn_mil_gt_zip

Sources

Source

Indexed 3 years ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About cyclops

Cyclops is a relatively minor ransomware group that emerged in July 2023, operating with apparent financial motivations and maintaining a low profile compared to established ransomware families. The group's origin and affiliations remain largely undocumented in public threat intelligence reporting, with limited information available regarding their operational structure or potential ties to other cybercriminal organizations. Based on available data, Cyclops has demonstrated geographically diverse targeting patterns, with documented victims spanning Australia, China, and Guatemala, though their specific attack methodologies, initial access vectors, and encryption techniques have not been extensively analyzed or reported by major security firms or law enforcement agencies. With only seven known victims documented since their emergence, the group represents a relatively small-scale operation that has not conducted any widely publicized high-profile attacks or drawn significant attention from cybersecurity researchers or law enforcement disruption efforts. Current intelligence suggests the group remains active but operates at a scale significantly below major ransomware families that typically dominate threat landscape reporting. The group has been linked to 7 public disclosures across our corpus. First observed on a leak site on July 1, 2023; most recent post July 26, 2023. The operation is currently inactive.

Timeline of this disclosure

  • July 1, 2023Guatemala Military Intelligence Directorate listed by cyclopson the group's public leak site

Other recent disclosures by cyclops

cyclops has been linked to 7 public victims on Darkfield. A sample of the most recent:

See the full cyclops dossier →

Sector and geography

This disclosure adds to ransomware activity in the Government sector, which has 685 disclosures indexed across all operators we track. Geographically, Guatemala Military Intelligence Directorate is reported in Guatemala, a country with 2 ransomware disclosures in our corpus.

If your organisation is affected

A listing by cyclops means Guatemala Military Intelligence Directorate appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

  • Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
  • Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
  • Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
  • Monitor for the data appearing on cyclops's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.