Colombia: banking and government lead detections

Trellix reported that banking and financial services made up 55.8% of detections in Colombia over a six-month period, followed by government at 23.1%. A separate Colombian independent outlet added that health represented 6.1%, and that PSE became a focal point for fraud and credential theft campaigns over the same period.

What did Trellix say about detections in Colombia?

Trellix said banking and finance accounted for most detections over six months, with government in second place. Local coverage around the report suggests attackers are shifting toward instant payment systems and access credentials, with PSE as a central target.

The report cited by Technocio also said threat actors are heavily targeting account-to-account systems and instant payments using AI-driven social engineering, keystroke replacement trojans, and credential phishing. Minuto60 echoed that view and broadened the picture to include the health sector in the detection map.

What techniques are being used against banking and payments?

The available reports describe campaigns that combine social engineering, credential theft, and banking-focused malware. In Colombia, Trellix pointed to attacks against instant payment systems such as PSE, while later technical research documented malware and payment fraud with components designed to evade analysis and capture sensitive data.

FortiGuard Labs, in an analysis summarized by SocPrime on Casbaneiro, explained that the trojan uses a multi-stage infection chain with HTA downloaders and AutoIt loaders. It also described geofencing to limit delivery to selected parts of Latin America and a distributed C2 infrastructure that intentionally returns HTTP 403 responses.

That same technical report listed concrete indicators of compromise for response teams in the region, including creation of a .Outlook file in %APPDATA%, MD5-named registry keys under HKCU\SOFTWARE, and malformed HTTP traffic without a Host header and with unusually large Content-Length values. It also warned that the malware injects code into legitimate Windows processes such as RegSvcs.exe and mobsync.exe.

What does the ShadowParasite campaign show in Colombia?

Lumu described ShadowParasite as a payment fraud operation focused on LATAM and especially Colombia, with fake portals for utility payments and financial institutions placed in search engines to capture payments and credentials. The research identified at least 288 domains and 47 impersonated brands.

The same investigation reconstructed at least seven months of partial activity and linked 51 initial domains and four IP addresses across four autonomous systems. It also found a panel impersonating 15 Colombian financial institutions on the same code base.

In that panel, some institutions asked for six-digit verification codes and card data. In six institutions, it also captured facial biometrics through photo and video, showing a high level of sophistication in campaigns aimed at the Colombian financial sector.

How does this fit into the regional context?

Infobae reported that the rise in cyberattacks across Latin America includes state-sponsored activity and that the impact reaches both the public and private sectors. The outlet also recalled the 2023 attack on IFX Networks, which affected 78 public entities and more than 760 private companies across the region.

That background now sits alongside more focused campaigns against banking, government, and instant payments. In Colombia, the combination of high detection volume, payment fraud, and banking malware points to a risk map that is no longer limited to a single technique or a single type of victim.

Was Zaswin compromised?

Based on the cited material, Zaswin does not appear as a compromised asset itself, but as a reference tied to phishing and fraud campaigns against banking in Colombia. The core of the reporting is how those operations target credentials, payments, and financial brands, not a confirmed intrusion into a company named Zaswin.

The reports included describe detections in banking and finance, along with campaigns that combine social engineering, malware, and fake payment portals. They also mention credential theft, phishing, and fraudulent pages, which helps explain why the query may surface in Google even when the original text does not describe a confirmed compromise.

Zaswin remittances exploit?

Zaswin appears in this story as a reference linked to phishing and fraud campaigns against banking in Colombia, not as a confirmed compromise of a company or service. What the cited reports do show is an ecosystem of credential theft, payment fraud, and banking malware that can surface in searches tied to remittances and exploits.

Trellix, FortiGuard Labs, Lumu, and other reports included in the article describe attacks against banking, instant payments, and fake portals, using techniques such as social engineering, trojans, and financial brand impersonation. In that context, the combination of Zaswin, remittances, and exploit looks more like a search association with fraud campaigns than an intrusion attributed to a single actor.