Zero-Day Weaponization: Ransomware Groups Exploit Unpatched Vulnerabilities in Latin America

In recent years, ransomware groups in Latin America have intensified their exploitation of zero-day vulnerabilities, leading to a significant increase in cyberattacks across the region. Zero-day vulnerabilities are previously unknown flaws in software that attackers can exploit before developers release patches, making them particularly dangerous.

Exploitation of Zero-Day Vulnerabilities

Between January 2023 and September 2024, Kaspersky identified 547 listings on dark web forums and shadow Telegram channels offering exploits targeting software vulnerabilities, with half involving zero-day and one-day vulnerabilities. These exploits are primarily used by cybercriminals to gain unauthorized access to systems and steal sensitive data. (me-en.kaspersky.com)

Akamai's research indicates that the use of zero-day and one-day vulnerabilities has led to a 143% increase in total ransomware victims between Q1 2022 and Q1 2023. Ransomware groups are increasingly targeting the exfiltration of files, which has become the primary source of extortion. (akamai.com)

Notable Ransomware Groups in Latin America

The Play ransomware group has been active in Latin America, exploiting zero-day vulnerabilities to gain SYSTEM privileges and deploy malware on compromised systems. In April 2025, Play exploited a high-severity Windows Common Log File System flaw in zero-day attacks. (en.wikipedia.org)

Clop, a Russian-speaking ransomware gang, has also targeted organizations in Latin America. In 2023, Clop exploited a zero-day vulnerability in MOVEit Transfer, affecting organizations worldwide, including those in Latin America. (en.wikipedia.org)

Exploit Broker Transactions

Exploit brokers play a significant role in the cyber threat landscape by facilitating the sale and purchase of zero-day vulnerabilities. For instance, in March 2025, a Russian exploit broker named Operation Zero offered up to $4 million for Telegram exploits, highlighting the lucrative nature of zero-day vulnerabilities. (techcrunch.com)

The U.S. government has taken action against exploit brokers; in February 2026, the U.S. Departments of the Treasury and State announced sanctions targeting a Russia-based cyber exploit broker network for the theft and resale of U.S. trade secret cyber tools. (connectontech.bakermckenzie.com)

Recommendations for Organizations

To mitigate the risks associated with zero-day vulnerabilities, organizations should:

• Implement Robust Patch Management: Regularly update and patch all software to address known vulnerabilities promptly.

• Enhance Monitoring and Detection: Deploy advanced monitoring tools to detect unusual activities indicative of exploitation attempts.

• Conduct Regular Security Assessments: Perform comprehensive security audits to identify and remediate potential vulnerabilities.

By proactively addressing these areas, organizations can strengthen their defenses against the evolving threat of zero-day exploitation.

Highlights:

• Kaspersky: half of dark web exploit listings target zero-day vulnerabilities, Published on Wednesday, October 02
• Akamai Research: Rampant Abuse of Zero-Day and One-Day Vulnerabilities Leads to 143% Increase in Victims of Ransomware, Published on Sunday, August 06
• Russian zero-day seller is offering up to $4 million for Telegram exploits | TechCrunch, Published on Thursday, March 20