Colombia Hit in Ransomware Campaigns

StrikeShark puts Colombia in the crosshairs

Kaspersky identified a cyberattack campaign called StrikeShark, associated with SharkLoader malware, that targeted government agencies, diplomatic entities and software development companies in multiple countries. Colombia is among the Latin American states affected, according to the material provided.

The operation remains under investigation and, according to Kaspersky, it has not yet been attributed to any known Advanced Persistent Threat group. The campaign’s origin and any possible link to state-backed actors have not been confirmed.

Attack on the Justice Ministry

In parallel, Colombia’s Ministry of Justice and Law confirmed in an official statement that it was hit by a ransomware attack on Aug. 2, 2026. The incident compromised part of its technology infrastructure and affected the availability of some digital services.

COLCERT inspected the data center, secured evidence and logs for forensic analysis, and remediation work began. The ministry also said it had not received prior warnings about the attack and that, so far, the theft or leak of information has not been publicly confirmed.

Local outlets including Publimetro, El Universal, El Colombiano, Caracol Radio and Red+ Noticias documented the case and reported that cybersecurity and preventive system isolation protocols were activated. They also said acting minister Cielo Rusinque and appointed minister Iván Cancino asked Fiscalía, Policía and other authorities to act quickly to identify those responsible, without any public attribution to a specific APT group.

A recurring pattern in the public sector

DataEnforce placed the incident within a recurring pattern of ransomware campaigns against Colombia’s public sector. Its analysis recalled the IFX Networks case in September 2023, which had a cascading impact on multiple state entities, including the Judicial Branch, the Ministry of Health and the Superintendency of Industry and Commerce.

The report also detailed behavioral indicators typically seen before ransomware deployment and recommended measures such as phishing-resistant MFA, inventory and oversight of shared infrastructure providers, and immutable offline backups.