La junta al desnudo

Estadísticas de campaña

Five sequential OSINT sweeps against Burkina Faso's digital infrastructure — telecoms, ministries, banks, police, judiciary, and the national data platform — produced the following aggregate results. All data was retrieved through unauthenticated public endpoints.

Un solo comando curl

It started — as it usually does — with a single line in a terminal.

curl -s https://trino.data.gov.bf/v1/statement -d "SELECT * FROM public_markets.entreprises"

The Trino SQL engine returned 2,101 company records. No authentication. No rate limiting. No firewall. Burkina Faso's national data lakehouse — created February 2, 2026 and running Apache Iceberg + Trino v476 + Nessie + MinIO + Apache Superset + Airflow — accepts unauthenticated SQL queries against every table in the catalog. The platform is operated by the government on behalf of the junta-led executive, and it serves the most sensitive procurement, bidder, and contract data of the state.

Three blocks of the audit covered different surfaces — an unauthenticated WordPress REST API across 25+ WordPress installs, a Strapi CMS leaking executive identities, and a Joomla/Drupal/TYPO3 zoo running on PHP 7.3 (EOL since December 2021) — but the single most damaging finding was simply that you could read everything by typing a SELECT.

No exploit was used. No credentials were brute-forced. No firewall was bypassed. The platform was, in practice, a public read replica of the Burkinabè state's procurement database — except the public did not know it was public.

Por qué Burkina Faso, por qué ahora

Burkina Faso is governed by a transitional military government that took power in September 2022 under Captain Ibrahim Traoré. The country is in active conflict with armed jihadist groups across more than 40% of its territory, has expelled French forces, has rotated toward Russia and the Africa Corps (Wagner's successor), and is under multiple sanctions regimes. In that posture, the digital perimeter of the state matters: every exposed ministry, every leaked email, every WordPress admin account is intelligence for someone.

ODINT does not take sides in Burkina Faso's domestic politics. Our mandate is to document what infrastructure is publicly visible, and to publish those findings so that citizens, journalists, and the affected institutions know what every internet-connected adversary already knows.

Objetivos auditados

The audit covered 110+ Burkinabè government, parastatal, banking, telecom, education, and media organizations. The following are the most consequential exposures, grouped by sector.

Infraestructura del gobierno y la junta

Defensa y seguridad (14 ministerios sobre el mismo TYPO3)

Banca y finanzas

Telecom y servicios críticos

Hallazgos críticos

Inteligencia de correos

Beyond the institutional accounts, ODINT recovered named-individual emails via website scrapes, WHOIS records, and DMARC fields. Where slugs in WordPress sites followed predictable patterns, ODINT inferred the underlying email addresses with marked confidence levels.

Notable named contacts include [email protected] (national cybersecurity agency), [email protected] (telecom DMARC admin), [email protected] (contractor managing ONEA), [email protected] (contractor registering the Presidency domain), and [email protected] (contractor registering SONABEL).

Cadena de contratistas

The Burkinabè state outsources its most sensitive web infrastructure to a small set of contractors. A compromise of any contractor cascades to every government site they manage.

Dominios y licencias

From ARCEP's regulatory spreadsheets and the .bf root zone, ODINT extracted dated license records for every mobile, fiber, broadcast TV, and tower-company operator in the country. The most consequential expirations are onea.bf (already expired 2025-05-17) and the TNT (digital TV) license held by Société Burkinabè de Telediffusion, expiring 2026-06-21 — within three months.

SONABEL, the national electricity utility, holds an FTTH fiber license alongside three private operators — a regulatory anomaly worth noting: the electricity grid operator is also a licensed telecom carrier.

Datos crudos y descargas

The complete evidence corpus has been archived and is available for researchers, journalists, and the affected institutions through ODINT's data server.

Qué significa esto

The state of Burkina Faso's digital perimeter is not the result of a single mistake. It is a structural pattern:

• Outsourcing of registration and operations to small contractors who allow domains to lapse, run development settings in production, and embed credentials in HTML.
• An EOL software baseline — PHP 7.3 across 14 ministries, Moodle 2.9 at the police academy, Joomla 3.7 at the National Police — that no one is patching.
• API-first platforms deployed with auth-last thinking — Strapi at SONABHY, Trino at data.gov.bf, WP REST across every ministry — exposing everything by default and then never being closed down.
• Centralized identity (Keycloak) with password grant enabled, which converts every leaked username and weak password into a usable government login.

For the institutions named in this report, the path forward is concrete: rotate every @rcpb.bf and @sig.bf password, disable WP REST user enumeration, close /typo3/install.php, put data.gov.bf behind authentication, revoke the password grant on the master Keycloak realm, and renew onea.bf before someone else does.