Mercenary Spyware and Exploit Brokers: A Rising Threat in Latin America

Introduction

In recent years, Latin America has witnessed a surge in cyber activities involving mercenary spyware and exploit brokers. These entities, often operating under the guise of commercial surveillance vendors, provide sophisticated tools and services that enable unauthorized surveillance and data extraction. Their operations have raised significant concerns regarding privacy, security, and the potential for abuse within the region.

Mercenary Spyware and Exploit Brokers

Mercenary spyware refers to surveillance software developed and sold by private companies to government agencies and law enforcement. These tools are designed to infiltrate target devices, extract data, and monitor communications without the user's consent. Notable examples include NSO Group's Pegasus, Cytrox's Predator, and Candiru's DevilsTongue. These companies have been implicated in various high-profile surveillance cases worldwide.

Exploit brokers play a crucial role in the cyber surveillance ecosystem by discovering and selling zero-day vulnerabilities—previously unknown flaws in software that can be exploited before a patch is available. These brokers often operate in a clandestine manner, facilitating the sale of exploits to the highest bidder, which can include both state and non-state actors. The lack of transparency and regulation in this market poses significant risks, as these exploits can be used for malicious purposes, including unauthorized surveillance and cyberattacks.

Red Team Frameworks and Surveillance-as-a-Service

Red team frameworks are structured approaches used by organizations to simulate adversarial attacks, assess vulnerabilities, and improve defensive measures. While these frameworks are primarily intended for defensive purposes, they can be repurposed for offensive operations. The integration of artificial intelligence into red team frameworks, as seen in projects like RedTeamLLM, has enhanced the sophistication and effectiveness of these simulations. However, the same technologies can be exploited by malicious actors to conduct more advanced and evasive cyber operations.

Surveillance-as-a-Service refers to the outsourcing of surveillance capabilities to third-party vendors. This model allows entities to access advanced surveillance tools and services without developing them in-house, thereby reducing costs and time to deployment. While it offers operational advantages, it also raises ethical and legal concerns, particularly regarding privacy rights and the potential for abuse.

Recent Developments in Latin America

In 2025, reports emerged of increased surveillance activities in Latin America attributed to the use of mercenary spyware. For instance, in December 2025, an Amnesty International Security Lab investigation uncovered that Intellexa's Predator spyware was used to target individuals in the region. The spyware was distributed through web advertising infrastructure, highlighting the sophisticated methods employed by these surveillance vendors. (en.wikipedia.org)

Additionally, the U.S. Department of Commerce added Cytrox AD in North Macedonia and Cytrox Holdings Zrt in Hungary to its Entity List in July 2023, citing their involvement in trafficking cyber exploits. This action underscores the international dimension of the mercenary spyware market and its implications for global cybersecurity. (en.wikipedia.org)

Implications and Recommendations

The proliferation of mercenary spyware and exploit brokers in Latin America poses significant challenges to cybersecurity and human rights. The ability of these entities to conduct surveillance without oversight increases the risk of abuse, including targeting journalists, activists, and political opponents.

To mitigate these risks, it is recommended that Latin American governments and organizations:

• Enhance Regulatory Frameworks: Develop and enforce regulations that govern the use of surveillance technologies, ensuring they are employed ethically and transparently.

• Strengthen Cybersecurity Measures: Invest in robust cybersecurity infrastructures to detect and prevent unauthorized surveillance activities.

• Promote International Cooperation: Collaborate with international partners to share information, best practices, and coordinate responses to the challenges posed by mercenary spyware.

Conclusion

The rise of mercenary spyware and exploit brokers represents a significant threat to the privacy and security of individuals in Latin America. Addressing this issue requires a comprehensive approach that includes regulatory oversight, technological defenses, and international collaboration to safeguard the rights and freedoms of the region's citizens.

Highlights:

• Amnesty International uncovers new hacking campaign linked to mercenary spyware company - Amnesty International, Published on Tuesday, March 28
• Commercial spyware vendor exploits used by Kremlin-backed hackers, Google says - Ars Technica, Published on Wednesday, August 28
• Cytrox