Cyberattack on French Interior Ministry Originates from Compromised Official's PC

On September 19, 2025, a functionary from the French Ministry of Agriculture clicked a malicious link, infecting his personal computer with the Rhadamanthys infostealer malware. This breach allowed attackers to access sensitive credentials, including a VPN authentication certificate stored in Google Drive. Subsequently, the attackers infiltrated the Ministry of Agriculture's network, remaining undetected for several weeks. By November 9, they discovered a connection to the Ministry of the Interior, ultimately compromising police data. The incident highlights significant vulnerabilities in state cybersecurity protocols and the consequences of human error. An investigation by the Office of Cybercrime revealed the extensive nature of the breach, emphasizing the need for improved security measures.

Key Points: • A functionary's compromised PC led to a breach of the Ministry of the Interior. • The malware Rhadamanthys collected sensitive data, including VPN credentials. • Attackers exploited weak security protocols to access police national files.