TheGarudaEye Downs Paraguay Foreign Ministry Over Trump’s Board of Peace

Paraguay’s Ministry of Foreign Affairs (Ministerio de Relaciones Exteriores) became the target of a cyberattack after its official website, mre.gov.py, went dark for a full 24 hours on August 10, 2026. The attack was carried out by hacktivist group TheGarudaEye, which directly tied the operation to Paraguay’s participation in Donald Trump’s “Board of Peace” initiative.

Timeline of the Attack

According to a report posted on TheGarudaEye’s Telegram channel, mre.gov.py began experiencing disruptions at 09:50 AM Paraguay time. Screenshots included in the report show a gradual progression of access failures: it started with a “Page not found” message referencing a missing Azure Front Door configuration, then escalated to a “502 Bad Gateway” error from nginx, and finally a “504 Gateway Timeout” error stating the origin server was not responding to requests routed through Azure Front Door.

The group attached two monitoring reports from check-host.net and check-host.cc to support the site’s downtime status. A global status map included in the material shows most checkpoint nodes flagging mre.gov.py as unreachable.

The stated attack duration was 86,400 seconds, equivalent to 24 hours.

Who Was Affected

The primary target of the attack was Paraguayan government digital infrastructure, specifically the Ministry of Foreign Affairs (Ministerio de Relaciones Exteriores). The ministry’s official domain, mre.gov.py, is the sole target named in the attack report, numbered #0125.

Background and Motive

TheGarudaEye pointed directly to a graphic listing countries seated on Trump’s “Board of Peace,” a forum established at the initiative of the former US President, with Paraguay specifically highlighted among the participating nations. The group framed Paraguay’s presence on that list as the justification for singling out the country’s foreign ministry.

In a message accompanying the attack report, TheGarudaEye alleged that funds channeled through Trump’s Board of Peace were embezzled and diverted to finance international geopolitical operations. The group also referenced a plan it called “New Gaza,” which it said was aimed at targeting regional demographic structures, describing member states of the board, Paraguay included, as complicit through their participation.

The attack forms part of a broader operation tagged #OpParaguay and #OpBoP, which the group frames as a geopolitical retaliation measure and defiance against the Trump-backed forum. In its acknowledgments, TheGarudaEye credited “God,” its alliance, and its supporters for contributing to the operation.

Official Response

As of publication, there has been no official statement from the Paraguayan government or from representatives of Trump’s Board of Peace regarding the incident.

CyberAsia.io will update this article as further developments emerge from relevant authorities.

Strategic Impact

The attack on Paraguay’s Ministry of Foreign Affairs adds to a growing list of hacktivist operations targeting government entities tied to Trump’s Board of Peace over international policy disagreements. The incident underscores how the Trump-brokered diplomatic forum is increasingly becoming a focal point for the narratives and actions of regionally aligned hacktivist groups worldwide.

Geopolitical Context: The Board of Peace

The cyberattack against Paraguay’s Ministry of Foreign Affairs occurs within a highly volatile geopolitical framework surrounding the “Board of Peace” initiative. Hacktivist collectives globally are increasingly targeting state-level foreign ministries to signal diplomatic dissatisfaction or to actively disrupt international relations infrastructure. By targeting the primary external digital footprint of the state, TheGarudaEye aims to force a public acknowledgment of their ideological stance. This incident clearly demonstrates the continued weaponization of cyber capabilities for geopolitical leverage, where independent actors attempt to insert themselves into state-level negotiations through asymmetric digital disruption.

Historically, foreign ministries are high-value targets for both state-sponsored Advanced Persistent Threats (APTs) and ideologically motivated hacktivists. The compromise or offline status of such a portal not only halts administrative functions but also damages the target nation’s digital reputation on the global stage. It highlights a critical failure in protecting public-facing assets during periods of heightened international tension.

Technical Attack Vectors

While the exact botnet infrastructure utilized by TheGarudaEye remains undisclosed, the disruption of critical government web applications typically relies on sophisticated Layer 7 (Application Layer) volumetric attacks. Unlike traditional Layer 3 or 4 attacks that attempt to simply saturate network bandwidth, Layer 7 attacks target the application layer directly by sending floods of legitimate-looking HTTP GET or POST requests. This rapid influx exhausts the server’s connection pool, backend database connections, and available CPU threads, leading to severe service degradation or a complete offline status for critical portals like mre.gov.py.

Defending against these sophisticated application-layer floods requires robust mitigation strategies. Organizations must deploy advanced Web Application Firewalls (WAF) capable of dynamic rate limiting and deep behavioral traffic analysis. In addition, implementing aggressive challenge-response mechanisms, such as invisible CAPTCHAs, is essential to successfully separate automated bot traffic from legitimate citizen access during active attack windows.

Mitigation & Prevention Strategies

To defend against advanced Layer 7 and volumetric DDoS attacks observed in these campaigns, organizations should implement the following defensive postures:

• Edge Protection. Deploy robust Web Application Firewalls (WAF) and Anti-DDoS solutions configured to challenge anomalous request rates (e.g., CAPTCHA or JS challenges) before they hit origin servers.
• Geographic Rate Limiting. If the threat actor originates from or utilizes botnets concentrated in specific regions, enforce geo-blocking rules for non-essential traffic.
• Infrastructure Scaling. Ensure load balancers and auto-scaling groups are optimized to absorb sudden traffic spikes while maintaining core service availability.

Disclaimer: CyberAsia is an independent Cyber Threat Intelligence (CTI) research organization. The information provided in this report is derived from public intelligence gathering, dark web monitoring, and threat actor claims. It is published strictly for educational purposes, defensive analysis, and public awareness. CyberAsia does not endorse, verify, or facilitate any cyberattacks or illegal activities.