Threat reportRansomwareTL-2026-4272
Caribbean Shared-Platform Compromises Cascade Into Global Cyber-Risk (Curaçao Government Ransomware, July 2025)
Caribbean Shared-Platform Compromises Cascade Into Global (TL-2026-4272), also tracked as Curaçao Tax Office ransomware incident, is a medium-severity ransomware operation, first published 2026-10-23. It has no confirmed attribution, affects Government of Curaçao Tax and Customs Administration (Belastingdienst), references 1 CVE (CVE-2025-6543), maps to 4 MITRE ATT&CK techniques (T1078, T1114, T1190), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4272
- Threat ID
- TL-2026-4272
- Also known as
- Curaçao Tax Office ransomware incident, Dutch Caribbean government cyberattacks July 2025
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, judiciary, tax-and-customs, legislature
- Target regions
- Caribbean, Curaçao, aruba, Kingdom of the Netherlands
- Detection rules
- 9
- Indicators of compromise
- 9
How Caribbean Shared-Platform Compromises Cascade Into Global works
On July 24, 2025 Curaçao's Tax and Customs Administration (Belastingdienst) discovered ransomware on its network, shutting counters, call center and internal processes for about ten days. A day earlier the Joint Court of Justice, which serves six Dutch Caribbean jurisdictions, took its network down after a virus was detected, and Aruba's Parliament reported a compromised email account in the same window.
Dark Reading's regional risk analysis argues that in the Caribbean a single shared platform can affect multiple governments, so one compromise cascades across jurisdictions. It cites Fortinet's Global Threat Intelligence reporting of roughly 325 million attack attempts across the English-speaking Caribbean in 2025, and says critical vulnerabilities are now targeted within 24-48 hours of disclosure (previously nearly five days). The analysis also treats annual third-party assurance as a control-design gap. Note: the Dark Reading page returned HTTP 403 to direct fetch, so these article claims are taken from the search-result summary and the hunt skeleton; the 325 million figure could not be independently confirmed in Fortinet material.
Incident facts were corroborated through other outlets. Curaçao's Tax and Customs Administration discovered ransomware on Thursday July 24, 2025. The finance minister, Javier Silvania, authorized Dutch cybersecurity specialists to assist, and the news first appeared on his Facebook page. In-person services, customer counters and the call center were closed and multiple internal systems were isolated; the online platform for filing and paying taxes stayed operational. Officials stated there were no indications that confidential data had been stolen, leaked or lost. Services reopened Monday August 4, 2025, with technical issues possibly persisting. The ransomware family, actor and initial access vector were not disclosed, and no ransom payment was officially confirmed.
On July 23, 2025 the Joint Court of Justice (serving Curaçao, Aruba, Sint Maarten, Bonaire, Saba and Sint Eustatius) detected a virus in its IT system and shut down its entire network as a precaution, suspending court operations for several days. The Parliament of Aruba separately reported a compromised email account, with email communications affected between July 23 and 28. The Record also notes that on July 22 the Netherlands' Public Prosecution Service alerted to a Citrix NetScaler vulnerability; no source ties that vulnerability to the Caribbean incidents, so no CVE is assigned here. Attribution is unknown. Severity MEDIUM is an analyst judgement from incident impact, not a source-stated score.
MITRE ATT&CK techniques used in TL-2026-4272
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
Collection
Affected products and versions in Caribbean Shared-Platform Compromises Cascade Into Global
- Government of Curaçao — Tax and Customs Administration (Belastingdienst) IT systems
Vulnerable versions: Not disclosed - Joint Court of Justice of Aruba, Curaçao, Sint Maarten, Bonaire, Sint Eustatius and Saba — Court IT network
Vulnerable versions: Not disclosed - Parliament of Aruba — Email accounts
Vulnerable versions: Not disclosed
Remediation for Caribbean Shared-Platform Compromises Cascade Into Global
Immediate actions
- Isolate affected systems on suspected ransomware and engage national CSIRT or external incident response support, as Curaçao did with Dutch specialists
- Review email accounts for compromise and force credential resets and MFA re-enrollment where mailbox compromise is suspected
- Patch internet-facing edge appliances (for example Citrix NetScaler) promptly, since exploitation is reported within 24-48 hours of disclosure
Workarounds
- Keep online filing and payment portals segmented from internal networks so they can stay available during an internal outage
Longer-term hardening
- Inventory shared platforms and cross-jurisdiction dependencies that could cascade across government entities
- Replace annual third-party assurance with continuous monitoring of shared-service providers
- Maintain offline, tested backups and a rehearsed manual-operations fallback for citizen-facing counters and call centers
- Establish clear incident communication protocols so disclosure goes through official channels
CVEs associated with Caribbean Shared-Platform Compromises Cascade Into Global
Timeline of Caribbean Shared-Platform Compromises Cascade Into Global
- Netherlands' Public Prosecution Service alerts to a Citrix NetScaler vulnerability (context reported by The Record; no source links it to the Caribbean incidents)
- Start of the July 23-28 window in which Aruba Parliament email communications were affected by a compromised email account
- Joint Court of Justice, serving six Dutch Caribbean jurisdictions, detects a virus and shuts down its entire network as a precaution
- Curaçao Tax and Customs Administration discovers ransomware; counters, call center and internal systems are closed or isolated
- Closure announced publicly; first revealed via Finance Minister Javier Silvania's Facebook page; Dutch specialists authorized to assist
- Curaçao Chronicle reports officials see no indications that confidential data was stolen, leaked or lost
- Only the Motor Vehicle Tax Department reopens (title transfers, pre-scheduled collection appointments, electronic payments at in-house cashiers); most tax office operations remain paralyzed (Curaçao Chronicle, July 29)
- Joint Court of Justice states stored data remains secure; counters reopened in Aruba, Curaçao, Sint Maarten and Bonaire, with Saba and Sint Eustatius expected the following week
- Telecommunications bureau issues urgent warning about increased ransomware activity in the Caribbean region
- Curaçao tax office reopens to the public; technical issues may persist
- The Record publishes coverage of the Curaçao and Aruba incidents
Sources cited for Caribbean Shared-Platform Compromises Cascade Into Global
- Why Caribbean Threats Cascade Into Global Cyber-Risk
- Dutch Caribbean islands respond to cyberattacks on courts, tax departments (The Record)
- Ransomware attack cripples Curaçao tax office, Dutch cybersecurity experts called in (Curaçao Chronicle)
- Belastingdienst Curaçao weer open na aanval met ransomware (TaxLive)
- NL Times coverage of Dutch Caribbean cyber incidents
- Partial services resume at Curaçao tax office after ransomware attack (Curaçao Chronicle)
- Joint Court of Justice provides update on network outage, data remains secure (Curaçao Chronicle)
- Malware forces Dutch Caribbean courts offline, highlighting growing cyber risks (Curaçao Chronicle)
- Netherlands: Citrix NetScaler flaw CVE-2025-6543 exploited to breach orgs (BleepingComputer)
- Dutch NCSC confirms active exploitation (The Hacker News)
Detection coverage for TL-2026-4272
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4272 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.