Latin American Ransomware Groups Expand Cyber Espionage Operations

Executive Summary

In early 2026, Latin American ransomware groups have evolved beyond traditional financial motives, increasingly engaging in cyber espionage activities. These groups are targeting supply chains, conducting SIGINT-linked intrusions, and focusing on diplomatic entities to gather intelligence. This shift poses a medium-level threat to regional cybersecurity and international relations.

Background

Historically, ransomware groups in Latin America have primarily focused on financially motivated attacks. However, recent trends indicate a strategic shift towards cyber espionage, leveraging ransomware tactics to infiltrate networks and exfiltrate sensitive information.

Key Findings

1. Supply Chain Compromise for Intelligence Collection

   Latin American ransomware groups are increasingly targeting supply chains to gain access to sensitive data. By compromising third-party vendors, these groups can infiltrate larger organizations, exfiltrating intelligence without direct engagement. This method allows for prolonged access and data collection, enhancing their espionage capabilities.

2. SIGINT-Linked Intrusions

   There is a notable increase in SIGINT-linked intrusions attributed to Latin American ransomware groups. By infiltrating communication networks, these groups can intercept and analyze sensitive communications, providing valuable intelligence. This tactic not only disrupts operations but also compromises the confidentiality of diplomatic and governmental communications.

3. Diplomatic Targeting

   Diplomatic entities are becoming primary targets for these ransomware groups. By accessing diplomatic communications and documents, they can gather intelligence on international negotiations, policies, and strategies. This information can be exploited for geopolitical advantage or sold to interested parties.

Notable Actors

• Royal (BlackSuit) Ransomware Group: Known for aggressive targeting and high ransom demands, Royal has expanded its operations to include cyber espionage activities. Their tactics involve sophisticated phishing schemes and exploitation of remote desktop protocols to gain initial access. (en.wikipedia.org)

• Lapsus$ Group: An international extortion-focused hacker group, Lapsus$ has been active in Latin America, employing social engineering tactics such as SIM swapping and MFA fatigue attacks to infiltrate networks. Their operations have included targeting suppliers and leveraging insider recruitment. (en.wikipedia.org)

Implications

The shift towards cyber espionage by Latin American ransomware groups has several implications:

• Increased Risk to Sensitive Information: Organizations, especially those in the public sector and critical infrastructure, face heightened risks of data breaches and intellectual property theft.

• Diplomatic Strains: Compromised diplomatic communications can lead to misunderstandings and tensions between nations, affecting international relations.

• Evolving Threat Landscape: The convergence of cybercrime and espionage necessitates a reevaluation of cybersecurity strategies and international cooperation.

Recommendations

1. Enhanced Monitoring and Detection: Implement advanced monitoring systems to detect unusual network activities indicative of espionage attempts.

2. Supply Chain Security: Strengthen security protocols for third-party vendors to prevent indirect access to organizational networks.

3. Diplomatic Cybersecurity Measures: Establish secure communication channels for diplomatic entities to safeguard sensitive information.

4. International Collaboration: Foster collaboration between nations to share intelligence and develop coordinated responses to cyber espionage threats.

Conclusion

The evolving tactics of Latin American ransomware groups underscore the need for a comprehensive approach to cybersecurity. By understanding and addressing these threats, organizations can better protect sensitive information and maintain the integrity of diplomatic relations.

Highlights:

• CrowdStrike Releases The 2025 LatAm Threat Landscape Report, Published on Tuesday, May 06
• Latin America sees sharp rise in ransomware, hacktivist attacks in 2025 amid expanding fraud and phishing threats - Industrial Cyber, Published on Tuesday, February 17
• China’s Cyber Espionage in Latin America: A Real Threat - Diálogo Américas, Published on Wednesday, December 24