Hacktivist Cyber Espionage Intensifies in Latin America Amid Rising Attacks

In recent months, Latin America has witnessed a significant surge in cyber espionage activities orchestrated by hacktivist groups. These actors are leveraging advanced techniques to infiltrate government agencies and corporate entities, aiming to advance political, environmental, and social causes.

Emergence of Guacamaya Hacktivist Group

A notable player in this landscape is the Guacamaya group, an international collective operating primarily in Central and Latin America. Guacamaya has been responsible for breaching major corporations and government institutions in countries such as Chile, Colombia, El Salvador, Guatemala, Mexico, and Peru. Their operations are driven by anti-imperialist and environmental motivations, targeting entities involved in extractivism and those perceived as infringing upon natural resources and indigenous communities. (en.wikipedia.org)

Targeted Attacks on Government Agencies

Hacktivist campaigns have increasingly focused on government systems across Latin America. In December 2025, organizations in the region experienced an average of 3,065 cyber attacks per week, marking a 26% year-over-year increase. This uptick is attributed to ransomware operations and the expanding exposure linked to the adoption of generative AI technologies. (blog.checkpoint.com)

In Puerto Rico, the Department of Transportation was targeted by a cyberattack that disrupted the issuance of driver's licenses. Although the attack was ultimately unsuccessful, it underscored the vulnerability of critical infrastructure to cyber threats. (darkreading.com)

Advanced Persistent Threats (APTs) and Long-Dwell Intrusions

The threat landscape also includes Advanced Persistent Threats (APTs) that conduct long-dwell intrusions for intelligence collection. These operations are characterized by their stealth and persistence, allowing attackers to maintain access to networks over extended periods. While specific details on APT activities in Latin America are limited, the region's increasing cyberattack frequency suggests a growing interest from such threat actors. (darkreading.com)

Analytical Assessment

The convergence of hacktivist and APT activities in Latin America presents a complex and evolving threat landscape. Hacktivist groups like Guacamaya are not only disrupting operations but also exfiltrating sensitive information to further their causes. The rise in APT activities indicates a strategic interest in the region's governmental and corporate data, potentially for espionage or geopolitical leverage.

Organizations in Latin America must enhance their cybersecurity posture by implementing robust defense mechanisms, conducting regular security audits, and fostering a culture of awareness to mitigate the risks posed by these sophisticated cyber threats.

Highlights:

• Cyberattacks Intensify Pressure on Latin American Governments, Published on Tuesday, March 31
• Cyber Attacks Surge in Latin America | Dec 2025, Published on Monday, January 12
• Surging Cyberattacks Boost Latin America to Riskiest Region, Published on Tuesday, January 27