Hacktivist Attacks on Critical Infrastructure in Latin America: A Rising Threat

Executive Summary

Hacktivist groups are increasingly targeting critical infrastructure in Latin America, posing significant risks to sectors such as energy, water, healthcare, and finance. This trend reflects a broader global shift where ideologically motivated actors are moving beyond traditional cyberattacks to more disruptive operations.

Current Threat Landscape

In the third quarter of 2025, hacktivist attacks on industrial control systems (ICS) in Latin America accounted for 25% of all such incidents, indicating a near doubling from the previous quarter. (thecyberexpress.com) These attacks have targeted critical sectors, including energy, water, and healthcare, highlighting the vulnerability of essential services to cyber threats.

Notable Threat Actors

Several hacktivist groups have been identified as active in the region:

• Guacamaya: An international group operating mainly in Central and Latin America, Guacamaya has targeted major corporations and governments in countries such as Chile, Colombia, El Salvador, Guatemala, Mexico, and Peru. (en.wikipedia.org)

• Z-Pentest: A Russia-linked hacktivist group, Z-Pentest has been observed targeting critical infrastructure, including ICS, with a significant increase in attacks in the second quarter of 2025. (securitymagazine.com)

Attack Vectors and Tactics

Hacktivist groups are employing a range of tactics to infiltrate critical infrastructure:

• Phishing and Social Engineering: Utilizing deceptive emails and communications to gain unauthorized access to systems.

• Exploitation of Vulnerabilities: Targeting unpatched software and misconfigured systems to gain entry.

• Ransomware Deployment: Encrypting critical data and demanding payment for its release.

The convergence of IT and operational technology (OT) networks has expanded the attack surface, making ICS and Supervisory Control and Data Acquisition (SCADA) systems particularly susceptible. (publicsafety.ieee.org)

Implications for Latin America

The escalation of hacktivist activities in Latin America poses several challenges:

• Operational Disruptions: Attacks can lead to service outages, affecting public health, safety, and economic stability.

• Data Breaches: Unauthorized access to sensitive information can result in data leaks and loss of public trust.

• Economic Impact: The financial sector is particularly vulnerable, with potential for significant economic repercussions from cyberattacks.

Recommendations

To mitigate the risks associated with hacktivist attacks on critical infrastructure, the following measures are recommended:

• Enhanced Cyber Hygiene: Regularly update and patch systems to address known vulnerabilities.

• Network Segmentation: Isolate OT networks from IT networks to limit the spread of attacks.

• Employee Training: Conduct regular training to recognize phishing attempts and other social engineering tactics.

• Incident Response Planning: Develop and regularly update incident response plans to ensure swift and effective action during a cyberattack.

By implementing these strategies, organizations can strengthen their defenses against hacktivist threats and enhance the resilience of critical infrastructure in Latin America.

Highlights:

• Hacktivist Attacks on Critical Infrastructure Soar: Cyble Report – The Cyber Express, Published on Sunday, November 02
• Hacktivism Increasingly Targeting Critical Infrastructure | Security Magazine
• Guacamaya (hacktivist group)