TRJ CYBERSECURITY INTEL REPORT
Category: Municipal Government Ransomware Attack
Features: Network infiltration, data exfiltration, ransom demand, delayed disclosure, law enforcement involvement
Delivery Method: Unknown exploit vector (likely phishing or credential compromise), followed by lateral movement and archive encryption
Threat Actor: Chort Ransomware Group — newly emergent ransomware gang active since late 2024, linked to cross-border attacks on government, education, and critical infrastructure
On the night of October 31, 2024, while most of Sheboygan, Wisconsin, was focused on Halloween festivities, a very different kind of mask was in use — one worn by a ransomware gang now confirmed to have compromised the city’s core data systems and exfiltrated personal information belonging to nearly 70,000 individuals.
The threat actor responsible: a relatively new but increasingly aggressive group identifying as Chort, which surfaced publicly in November 2024 and immediately began targeting public institutions, municipalities, and educational systems with high-stakes ransomware campaigns and extortion threats.
For months, city officials downplayed the severity of the breach, originally suggesting that no sensitive data had been stolen. That changed on May 24, 2025, when breach notification letters were officially filed with regulators confirming the worst: Social Security numbers, state ID records, and license plate data had been extracted from city servers during the attack.
HOW IT HAPPENED — AND WHAT WAS TAKEN
Though the exact point of entry remains undisclosed, indicators suggest the attack leveraged either a phishing campaign or credential abuse to access Sheboygan’s internal systems. Once inside, the attackers deployed data harvesting tools and encrypted critical archives, including records tied to city residents, vehicle registration systems, and official ID documentation.
The stolen data included:
- Full Social Security Numbers
- State-issued identification numbers
- Registered license plate information
- Contact data tied to municipal services
Despite the breach, emergency services remained functional, though the city remained largely silent after a November 22 update — leading many to speculate that negotiations or legal barriers may have delayed public disclosure.
CHORT: A NEW NAME IN A FAMILIAR WAR
Chort Ransomware may be a new face, but its tactics align with a broader evolution in ransomware strategy: targeting state institutions, demanding high payouts, and threatening public exposure via leak sites.
Following the Sheboygan incident, Chort listed additional victims including:
- Kuwait’s Public Authority of Agriculture Affairs and Fish Resources
- Hartwick College in New York, which confirmed a breach affecting 4,800 individuals
- A public school district in Georgia
- Multiple local governments across the U.S. Midwest
Chort publicly released screenshots of archived file structures from Sheboygan’s internal networks — a move designed to pressure officials into negotiation, while signaling the successful compromise to other potential targets.
A DELAYED DISCLOSURE — AND A FAMILIAR RESPONSE
The city claims it hired an external cybersecurity firm to conduct a full forensic investigation, completed on May 14, 2025. The findings confirm that data was not only accessed — it was taken, contradicting the city’s earlier assurance.
In response, Sheboygan is offering one year of identity protection services to those affected. Critics argue this is a weak gesture for an attack of this scale — particularly when the personal information exposed could be sold, repurposed, or used in identity fraud schemes for years.
THE WIDER PATTERN: WISCONSIN UNDER ATTACK
Sheboygan joins a growing list of Wisconsin municipalities targeted in the past two years, suggesting that state-level defenses across the Midwest remain underprepared for modern ransomware assaults. As attacks increase in complexity and scope, municipalities with outdated infrastructure and limited budgets become ideal targets — lacking both the deterrents and detection systems needed to halt such incursions.
This attack wasn’t random. It was strategic — timed, executed, and escalated during a vulnerable moment when most residents were unaware anything had happened.
TRJ CONCLUSION: A GHOST TOWN IN THE CLOUD
The most dangerous breach isn’t the one that brings systems down. It’s the one that silently empties your records, impersonates your identity, and leaves no trace until the damage is irreversible.
Chort’s arrival signals a new wave of ransomware built on extortion, visibility, and systemic intimidation. If cities like Sheboygan — and the countless others now listed on dark web leak sites — don’t invest in proactive cyber defense, this will not be an isolated story.
It will be a national playbook.
🔥 NOW AVAILABLE! 🔥
📖 INK & FIRE: BOOK 1 📖
A bold and unapologetic collection of poetry that ignites the soul. Ink & Fire dives deep into raw emotions, truth, and the human experience—unfiltered and untamed.
🔥 Kindle Edition 👉 https://a.co/d/9EoGKzh
🔥 Paperback 👉 https://a.co/d/9EoGKzh
🔥 Hardcover Edition 👉 https://a.co/d/0ITmDIB
Get your copy today and experience poetry like never before. #InkAndFire #PoetryUnleashed #FuelTheFire
🚨 NOW AVAILABLE! 🚨
📖 THE INEVITABLE: THE DAWN OF A NEW ERA 📖
A powerful, eye-opening read that challenges the status quo and explores the future unfolding before us. Dive into a journey of truth, change, and the forces shaping our world.
🔥 Kindle Edition 👉 https://a.co/d/0FzX6MH
🔥 Paperback 👉 https://a.co/d/2IsxLof
🔥 Hardcover Edition 👉 https://a.co/d/bz01raP
Get your copy today and be part of the new era. #TheInevitable #TruthUnveiled #NewEra
🚀 NOW AVAILABLE! 🚀
📖 THE FORGOTTEN OUTPOST 📖
The Cold War Moon Base They Swore Never Existed
What if the moon landing was just the cover story?
Dive into the boldest investigation The Realist Juggernaut has ever published—featuring declassified files, ghost missions, whistleblower testimony, and black-budget secrets buried in lunar dust.
🔥 Kindle Edition 👉 https://a.co/d/2Mu03Iu
🛸 Paperback Coming Soon
Discover the base they never wanted you to find. TheForgottenOutpost #RealistJuggernaut #MoonBaseTruth #ColdWarSecrets #Declassified
Support truth, health, and preparedness by shopping the Alex Jones Store through our link. Every purchase helps sustain independent voices and earns us a 10% share to fuel our mission. Shop now and make a difference!
https://thealexjonesstore.com?sca_ref=7730615.EU54Mw6oyLATer7a
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
