Cybercriminals Intensify Attacks on Latin America's Critical Infrastructure

Executive Summary

In early 2026, cybercriminal activities targeting critical infrastructure in Latin America have escalated, with significant incidents affecting power grids, water systems, industrial control systems (ICS), healthcare facilities, and the financial sector. This surge underscores the region's heightened vulnerability to cyber threats and the urgent need for robust cybersecurity measures.

Current Threat Landscape

Latin America has emerged as a global hotspot for cyberattacks, with organizations experiencing an average of 3,065 attacks per week in 2025—a 26% increase from the previous year. (blog.checkpoint.com) This surge is driven by factors such as rapid technological adoption, political instability, and challenges in law enforcement. (abit.ee)

Targeted Sectors

• Power Grids and Water Systems: In February 2025, Chile experienced a nationwide blackout affecting over 90% of the population. The outage was attributed to a malfunction in electronic and software protection systems, leading to the disconnection of a critical 500 kV high-voltage transmission line. While the incident was officially deemed a technical failure, the possibility of a cyberattack remains a concern. (en.wikipedia.org)

• Industrial Control Systems (ICS): Hacktivist groups like Z-Pentest and Dark Engine have increasingly targeted ICS environments in Latin America. These groups have demonstrated the capability to infiltrate and disrupt critical infrastructure, posing significant risks to sectors such as energy, manufacturing, and agriculture. (cyble.com)

• Healthcare Facilities: The healthcare sector has been a prime target for ransomware attacks. In June 2025, the Paraguayan government faced a ransomware attack by the group Brigada Cyber PC, which encrypted files and demanded a ransom of approximately $7.4 million. Although the government denied paying the ransom, the incident highlighted the sector's vulnerability to cyber threats. (en.wikipedia.org)

• Financial Sector: The financial sector has also been targeted by cybercriminals. In June 2025, Iranian-backed hackers targeted U.S. banks, defense contractors, and oil industry companies following American strikes on Iranian nuclear facilities. Although critical infrastructure disruptions were minimal, the incident underscored the potential for cyberattacks to impact financial institutions. (apnews.com)

Notable Threat Actors

• Z-Pentest: A Russia-aligned hacktivist group that has emerged as a leading threat actor targeting ICS systems. In the second quarter of 2025, Z-Pentest was responsible for 38 ICS attacks, reflecting a significant increase from previous periods. (cyble.com)

• Dark Engine: Another Russia-linked group, Dark Engine has been active in targeting ICS environments, with 26 ICS-targeted incidents in the second quarter of 2025. The group has demonstrated a high level of technical capability and strategic intent in its operations. (cyble.com)

Conclusion

The escalation of cybercriminal activities targeting critical infrastructure in Latin America presents a significant threat to national security and economic stability. The region's rapid technological adoption, coupled with political instability and law enforcement challenges, has created a fertile ground for cybercriminals. It is imperative for Latin American nations to enhance their cybersecurity frameworks, invest in advanced threat detection and response capabilities, and foster international collaboration to mitigate these evolving cyber threats.

Highlights:

• Maduro raid had telltale signs of a cyber-enabled blackout, Published on Thursday, January 08
• Iranian-backed hackers go to work after US strikes, Published on Tuesday, June 24