Ransomware Threatens Latin America's Critical Infrastructure

Executive Summary

In early 2026, Latin America has witnessed a significant surge in ransomware attacks targeting critical infrastructure sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. These attacks have escalated in both frequency and sophistication, posing substantial threats to national security and economic stability.

Current Threat Landscape

Between August 2024 and July 2025, Mexico experienced over 237,000 ransomware attack attempts, ranking it among the most affected countries in Latin America. (blog.tecnetone.com) Brazil and Argentina have also reported significant increases in cyberattacks, with Brazil being the most targeted country in the region. (crowdstrike.com)

Targeted Sectors

• Power Grids and Water Systems: In October 2024, Brazil's Saneamento Básico do Estado de São Paulo (Sabesp), a major water utility, suffered a cyberattack that led to system instabilities and service disruptions. (ics-cert.kaspersky.com)

• Industrial Control Systems (ICS): The "Werewolves" ransomware group has been active since 2023, targeting industrial enterprises, including energy organizations, with sophisticated attacks employing tools like Anydesk, Netscan, CobaltStrike, Meterpreter, and Lockbit. (ics-cert.kaspersky.com)

• Healthcare Sector: The "Qilin" ransomware group has targeted 18 publicly disclosed victims in the healthcare sector between January and April 2025, employing spear-phishing campaigns and advanced malware to infiltrate systems. (flashpoint.io)

• Financial Sector: Ransomware attacks have also targeted financial institutions, with groups like "Werewolves" employing sophisticated techniques to infiltrate and disrupt operations. (ics-cert.kaspersky.com)

Notable Threat Actors

• "Werewolves": Active since 2023, this group employs a traditional double extortion technique, utilizing tools such as Anydesk, Netscan, CobaltStrike, Meterpreter, and Lockbit to target various sectors, including energy and financial organizations. (ics-cert.kaspersky.com)

• "Qilin": Also known as the Agenda ransomware group, "Qilin" has been active since January 2025, targeting over 700 victims in 62 countries, primarily in developed markets and high-value industries, including healthcare. (ics-cert.kaspersky.com)

Implications and Recommendations

The escalating ransomware activity in Latin America underscores the need for enhanced cybersecurity measures across critical infrastructure sectors. Organizations should implement robust security protocols, conduct regular system audits, and invest in employee training to mitigate the risk of such attacks. Collaboration between public and private sectors is essential to develop comprehensive strategies to defend against these evolving cyber threats.

Given the high threat level and the critical nature of the targeted sectors, it is imperative for stakeholders to prioritize cybersecurity initiatives to safeguard national interests and maintain public trust.

Geography: Latin America

Actor Type: Ransomware Group

Threat Level: High

Source Type: Proprietary

Confidence Level: High Confidence

Verification Status: Verified

Tags: Ransomware, Cybersecurity, Critical Infrastructure, Latin America

Read Time: 5 minutes

Source: Raptor Cyber Intelligence

Note: This briefing is based on the latest available data as of March 12, 2026.