Hace 7 días me reventaron el vidrio del carro y se robaron todas mis pertenencias.
Lo más triste, es que LA PLAZA SAN JORGE no ha querido ayudarme, les pedí cámaras y nada. (No ayudar te hace cómplice).
Tengan cuidado, acá no es un lugar seguro.
🚨 CYBER INTELLIGENCE ALERT: CRITICAL COMPROMISE OF THE MINISTRY OF FINANCE - GUATEMALA 🇬🇹
⚠️ MASSIVE EXFILTRATION OF 130K RECORDS AND 324GB OF SENSITIVE DOCUMENTATION
[STATUS: UNDER INVESTIGATION]
The threat actor "GordonFreeman" of LAT4MFUCK3RS has claimed full compromise of the RGAE (General Registry of State Acquisitions) system of the Guatemalan Ministry of Finance. The attacker claims to have exploited critical API-level vulnerabilities to bypass perimeter protections (WAF/Cloudflare) and extract the complete database of suppliers and registered individuals.
👤 Threat Actor: LAT4MFUCK3RS., GordonFreeman
🎯 Affected Entity: Ministry of Public Finance (RGAE).
📂 Data Volume: 130,000 records (2020-2026) + 235,000 PDF files.
📦 Total Size: 324.5 GB of exfiltrated information.
📊 ANALYSIS OF EXPOSED INFORMATION (PII AND DOCUMENTARY)
The leak includes not only structured data, but also legal and financial documentation that compromises the identity of thousands of citizens and companies:
Structured Data (Database):
Full names, Tax Identification Number (NIT), National Identification Code (CUI).
Residential addresses, telephone numbers, and email addresses.
Type of organization (Individual/Legal Entity).
Critical Documentation (PDF Files):
University degrees and scanned copies of national identity cards.
SAT invoices, tax clearance certificates, and business licenses.
Company incorporation documents and notarial deeds.
Bank statements, balance sheets, and administrative contracts.
🔍 TECHNICAL EVIDENCE AND VECTORS
The attacker detailed the methods used, confirming a systemic flaw in the portal's security architecture.
🛡️ WAF Evasion: Use of simulated legitimate traffic to avoid volume-based blocking.
🔓 API Vulnerabilities:
IDOR/BOLA: Unauthorized access to request sections (/api/Request/GetSections).
Open APIs: Unauthenticated endpoints directly connected to SAT systems (/api/sat/email).
🛡️ MITIGATION AND RECOMMENDATIONS
🛑 Urgent API Closure: The Ministry of Finance must audit and immediately close the exposed API endpoints and reconfigure authentication under the principle of least privilege.
⚠️ Massive Risk of Impersonation: Given the exfiltration of DPIs and signatures, banking institutions and the SAT (Tax Administration Service) must strengthen identity verification controls for both in-person and remote transactions.
🔒 Social Engineering Alert: The 130,000 affected individuals are at extreme risk of targeted phishing attacks or extortion, as attackers possess their physical addresses and financial solvency details.
⚡ MONITORING
🌐 Intelligence Platform: https://t.co/wk9bZJ3laQ
#CyberSecurity #Guatemala #DataBreach #MinistryOfFinance #RGAE #SAT #PII #CyberAlert #VECERT #LAT4MFUCK3RS
No olvidar:
- ¿Pero 40 mensuales?
- No. 40 millones.
- ¿Tanto va a dar?
- Sí
- ¿En serio?
- Por dios.
- ¿Tanta plata tiene, pues?
- Ah sí, Sandrita. Si en las farmacéuticas nos ha ido bien. Viera qué bonito nos ha ido.
El último mes mi vida ha sido tan random que un día estoy montado en un bus, luego almorzando en Biba's, luego comiéndome un elote asado, fundiendo un carro en Santa María de Jesús para terminar en El Salvador trabajando
HISTÓRICO TÍTULO QUE SE VA HASTA GUATEMALA 🏆🇬🇹
Lester Martínez consigue el Título Interino Supermediano del WBC 🤩
El guatemalteco derrotó a Aleem por decisión unánime y da el primer campeonato mundial a Guatemala 🙌🔥