The attack first surfaced publicly on September 16, when a listing appeared on the criminal group's dark web leak site naming the "Namibian Defence Force" and showing the ministry's domain, www.mod.gov.na. A monitoring service estimated the initial intrusion took place around September 12, four days before the listing.
Double-extortion tactic used
Nam-CSIRT described the incident as a double-extortion attack, in which the criminals both lock victims out of their own systems and threaten to publish stolen data if a ransom is not paid. As of publication, no verified figure for the volume of data involved and no confirmed initial point of entry had been disclosed.
Young agency faces major test
The confirmation places a major burden on Nam-CSIRT, an institution that launched only on April 16, 2025 and is now managing one of the most significant cybersecurity crises in the country's history. The incident is a stark reminder that government and defense institutions are increasingly targeted by organized ransomware operations.
