www.lemonde.fr Cyberattack on French Interior Ministry Originates from Compromised Official's PC
Article Content
- •A functionary's compromised PC led to a breach of the Ministry of the Interior.
- •The malware Rhadamanthys collected sensitive data, including VPN credentials.
- •Attackers exploited weak security protocols to access police national files.
On September 19, 2025, a functionary from the French Ministry of Agriculture clicked a malicious link, infecting his personal computer with the Rhadamanthys infostealer malware. This breach allowed attackers to access sensitive credentials, including a VPN authentication certificate stored in Google Drive. Subsequently, the attackers infiltrated the Ministry of Agriculture's network, remaining undetected for several weeks. By November 9, they discovered a connection to the Ministry of the Interior, ultimately compromising police data. The incident highlights significant vulnerabilities in state cybersecurity protocols and the consequences of human error. An investigation by the Office of Cybercrime revealed the extensive nature of the breach, emphasizing the need for improved security measures.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Rhadamanthys and Interpol in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Mass Credential Exposures Across Major Corporations Lunar Cyber reported 747,485 credential exposure events linked to ten large organizations, primarily in technology, finance, and retail. The analysis revealed that infostealer malware and breach databases were responsible for these exposures, with Apple showing over 46 million total events, but only 209,767 tied to… 
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…