LatAm ransomware hits critical infrastructure

A report from Entel Digital cited by Diario Financiero recorded 1,080 ransomware victims in Latin America between January 2025 and September 2026. Of that total, 338 cases, or 31.3%, affected critical infrastructure. In the region, transport and logistics accounted for 27.8% of victims, followed by energy, fuels, water and sanitation at 22.2%, and health and government at 16.7% each.

Which sectors accounted for the most cases?

According to the report cited by Diario Financiero, the heaviest burden fell on transport and logistics, energy, fuels, water and sanitation, health and government. The breakdown shows the incidents were not concentrated in a single industry, but across areas that support essential operations and public services in the region.

What is known about Qilin and Dire Wolf in the region?

Available records show disclosed victims associated with Qilin and Dire Wolf, but the sources make clear these are public metadata, not independently verified intrusion confirmations. In Qilin's case, the ACSec Ransomware Observatory lists the Municipal Water and Sewer Commission of Victoria, Mexico, ConAuto in Ecuador, and Confipetrol in Colombia.

ACSec also lists Interseguro in Peru and Softruck in Brazil among the disclosed victims associated with Dire Wolf. Mercados y Seguros, for its part, attributed to Qilin the highest directed activity among the RaaS operators observed in the first half of 2026 and cited a presence in critical infrastructure across the Southern Cone and northern Latin America, although it did not provide individual cases or independent confirmation of each incident.

What did Infobae say about Interseguro?

Infobae reported that Dire Wolf included Interseguro, Peru, on its extortion portal and claimed to have exfiltrated about 2.5 TB of information, including alleged internal documents, source code, database backups and personal records. The company said the potentially accessible data would not allow transactions to be compromised or insurance operations to be carried out.

What technical characteristics are attributed to Dire Wolf?

SOC Prime describes Dire Wolf as a double-extortion ransomware family whose encryptor is based on Go and packed with UPX. The analysis also points to use of ChaCha20, shadow copy deletion, log wiping and service termination as observed capabilities.

What vulnerability was linked to Qilin and Settra?

Secondary coverage cited by iSec and TMCnet said operators linked to Qilin and Settra were exploiting CVE-2026-0257 to access internal networks through GlobalProtect. Those findings did not include confirmation from the vendor or a demonstrated link to Latin American victims, and no original Palo Alto Networks advisory was verified in the results.