State-Sponsored Cyber Operations in Latin America: A 2026 Assessment

Introduction

As of March 2026, Latin America has experienced a notable increase in state-sponsored cyber operations. These activities, often attributed to nation-state actors, have targeted various sectors, including government agencies, telecommunications, and critical infrastructure. This briefing provides an overview of recent developments, identifies key threat actors, and assesses the implications for regional security.

Recent Developments

In 2025, Latin America witnessed a significant surge in cyberattacks, with organizations experiencing an average of 3,065 attacks per week—a 26% year-over-year increase. (blog.checkpoint.com) This uptick was driven primarily by ransomware operations and expanding exposure linked to enterprise adoption of generative AI. Notably, Brazil emerged as the most targeted country, absorbing 315 billion cyberattacks in the first half of 2025, accounting for 84% of all Latin American attempts. (riotimesonline.com)

Identified Threat Actors

Several nation-state actors have been linked to cyber operations in the region:

• China-Nexus Adversaries: Chinese state-sponsored groups have targeted government agencies, telecommunications, and military entities across Latin America. These operations align with Beijing's economic and diplomatic objectives, reflecting a strategic interest in the region. (crowdstrike.com)

• North Korean Actors: North Korea-linked groups have conducted financially motivated campaigns, including schemes involving fraudulent IT remote workers, indicating a diversification of their cyber activities. (industrialcyber.co)

• Latin American-Based Groups: The threat cluster known as Blind Eagle, active since at least 2018, has exploited vulnerabilities to compromise Colombian judicial and government institutions, deploying remote access trojans to facilitate espionage. (industrialcyber.co)

Implications for Regional Security

The involvement of nation-state actors in cyber operations within Latin America has several implications:

• Geopolitical Tensions: The U.S.-China rivalry has extended into South American government servers, with Chinese hackers operating undetected inside ministries for years. (riotimesonline.com)

• Economic Impact: The surge in cyberattacks, particularly ransomware, has led to significant financial losses for organizations in the region, affecting both public and private sectors.

• Operational Challenges: The sophistication of state-sponsored cyber operations poses challenges for regional cybersecurity capabilities, necessitating enhanced cooperation and resource allocation.

Conclusion

The landscape of state-sponsored cyber operations in Latin America is evolving, with nation-state actors increasingly targeting the region's critical infrastructure and governmental entities. The persistence and sophistication of these threats underscore the need for robust cybersecurity measures and international collaboration to safeguard regional stability and security.

Recommendations

• Enhanced Cybersecurity Measures: Organizations should implement comprehensive cybersecurity frameworks, conduct regular vulnerability assessments, and invest in advanced threat detection systems.

• International Collaboration: Strengthening partnerships with international cybersecurity agencies can facilitate information sharing and coordinated responses to cyber threats.

• Public Awareness Campaigns: Educating the public and private sectors about cyber threats and best practices can reduce the risk of successful attacks.

By proactively addressing these challenges, Latin America can bolster its resilience against state-sponsored cyber operations and mitigate potential risks to its digital infrastructure.

Highlights:

• CrowdStrike Releases The 2025 LatAm Threat Landscape Report, Published on Tuesday, May 06
• Cyber Attacks Surge in Latin America | Dec 2025, Published on Monday, January 12
• Why the World's Superpowers Are Fighting a Secret War Inside, Published on Monday, February 02