Disclosure context

About cyclops

Cyclops is a relatively minor ransomware group that emerged in July 2023, operating with apparent financial motivations and maintaining a low profile compared to established ransomware families. The group's origin and affiliations remain largely undocumented in public threat intelligence reporting, with limited information available regarding their operational structure or potential ties to other cybercriminal organizations. Based on available data, Cyclops has demonstrated geographically diverse targeting patterns, with documented victims spanning Australia, China, and Guatemala, though their specific attack methodologies, initial access vectors, and encryption techniques have not been extensively analyzed or reported by major security firms or law enforcement agencies. With only seven known victims documented since their emergence, the group represents a relatively small-scale operation that has not conducted any widely publicized high-profile attacks or drawn significant attention from cybersecurity researchers or law enforcement disruption efforts. Current intelligence suggests the group remains active but operates at a scale significantly below major ransomware families that typically dominate threat landscape reporting. The group has been linked to 7 public disclosures across our corpus. First observed on a leak site on July 1, 2023; most recent post July 26, 2023. The operation is currently inactive.

Timeline of this disclosure

July 1, 2023Guatemala Military Intelligence Directorate listed by cyclopson the group's public leak site

Sector and geography

This disclosure adds to ransomware activity in the Government sector, which has 509 disclosures indexed across all operators we track. Geographically, Guatemala Military Intelligence Directorate is reported in GT, a country with 2 ransomware disclosures in our corpus.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.

Ransomware victim disclosure

← All victims

Guatemala Ministry of National Defence – Military Intelligence Directorate (DIEMDN)

listed as Guatemala Military Intelligence Directorate · Claimed by cyclops · listed 3 years ago

35m

Age

since listed · data leaked

Status timeline

Listed
Jul 1, 2023
Data leaked

At a glance

Group: cyclops
Status: Data leaked
Country: GT
Sector: Government
Listed on leak site: Jul 1, 2023

About the victim

AI dossier — public-source company profile

The Guatemala Ministry of National Defence (Ministerio de la Defensa Nacional) is the Guatemalan government agency responsible for the budget, training, and policy of the country's armed forces, comprising the Army, Navy, Air Force, and Presidential Honor Guard. The Military Intelligence Directorate (DIEMDN – Dirección de Inteligencia del Estado Mayor de la Defensa Nacional) is the military intelligence arm operating under the Ministry. It is headquartered in Guatemala City.

Industry: Defence & Military Intelligence
Address: Guatemala City, Guatemala

Attack summary

Severity: critical — The victim is a national military intelligence directorate; exfiltration of intelligence files from a defence ministry constitutes a critical national-security exposure involving potentially classified government and defence data.

The Cyclops ransomware group claims to have exfiltrated data from the Guatemalan Military Intelligence Directorate (DIEMDN), publishing a download link to an archive (diemdn_mil_gt.zip) hosted on AnonFiles as proof of the breach; no ransom demand or encryption claim is stated.

critical

Data the group says was taken

AI dossier — extracted from the leak post

Military intelligence directorate files (diemdn_mil_gt.zip)

The group's post references roughly 1 proof file.

What the group claims

The Guatemalan Armed Forces (Fuerzas Armadas de Guatemala) consists of the National Army of Guatemala (Ejercito Nacional de Guatemala, ENG), the Guatemalan National Defense Navy (Marina de la Defensa Nacional, includes Marines), the Guatemalan Air Force (Fuerza Aerea Guatemalteca, FAG), and the Presidential Honor Guard (Guardia de Honor Presidencial).The Ministry of National Defence is the agency of the Guatemalan government responsible for the budget, training and policy of the armed forces. Based in Guatemala City, the Defence Ministry is heavily guarded, and the President of Guatemala frequently visits. As of 2017 the Minister of National Defence is Major General Luis Miguel Ralda Moreno.The Minister of Defense is responsible for policy. Day-to-day operations are the responsibility of the military chief of staff and the national defense staff.Data:===========https://anonfiles.com/F9pbi8zdzb/diemdn_mil_gt_zip

Sources

Victim sitemindef.mil.gt

Source

Indexed 3 years ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.