Energy, Electricity and Utilities Critical Infrastructure

Active Threats and Campaigns

Ransomware, extortion, and leak site mentions

The month produced only one case in which ransomware or extortion was the main focus, but the source does not let us determine whether the impact involved encrypted assets, exfiltration without encryption, or only a mention of the victim on a leak site. That distinction matters because it changes the operational reading completely. A leak site mention without verified impact is not the same as system downtime, and exfiltration does not necessarily mean encryption.

The Ecopetrol-related material sits squarely in that gray area. VECERTRadar, Kalir, Tornews and Ransomware.live reflect different forms of attribution or exposure, but all remain at the level of allegation or third-party recording, not a public forensic confirmation by the company. BNamericas did confirm in July 2026 that Ecopetrol activated its cybersecurity protocol after detecting that an external actor had stolen corporate information, but that event belongs to the comparative frame of prior months and not to September’s volume.

That time gap matters as well. In September, the ransomware signal in Latin American utilities was much weaker than in July, which does not mean the risk disappeared. It means the month was driven more by preventive activity, disruption cases and leak allegations than by confirmed encryption campaigns within the period.

Fraud and phishing

The clearest fraud scheme of the month was the impersonation of UTE officials to capture WhatsApp codes. It is a classic social engineering technique, adapted to a utility context, with a believable script for the victim and a secondary target that goes beyond the company, taking over the messaging channel to request money from contacts. In impact terms, this combines reputational damage, social engineering and account takeover, although it does not directly compromise power operations.

The value of this campaign for the sector is that it shows how a trusted public brand can be used to open a human breach without exploiting technical vulnerabilities. The response, therefore, is not only technological. It requires customer messaging, verification procedures, staff training and coordination with law enforcement. The material also offers a concrete operational recommendation, use the official "Verificá" system, which should be reinforced in public awareness campaigns.

APT and hacktivism

The material did not include a solid case of APT or hacktivism attributed to the energy, electricity and utilities vertical in September. There was, however, public discussion about sabotage, vandalism and intentional damage around the blackout in southeastern Mexico, but the available information did not allow confirmation of a cyber component or a persistent campaign. In Cuba and Venezuela, there was also no attribution to specific actors, and the events remained in the realm of grid crisis and supply stability.

The absence of a closed attribution should not be read as the absence of threat. It shows, instead, that in this month the public evidence available was insufficient to classify persistent or hacktivist campaigns in this vertical. The operational reading should therefore focus on availability, interagency coordination and fraud prevention, rather than forcing an actor label where the material does not support one.

Critical vulnerabilities

No critical CVEs were recorded in the source material with enough technical detail for this report, although the period indicator lists 2 critical CVEs. That figure shows that references to critical vulnerabilities appeared in the coverage, but the available material does not provide enough detail to describe exploitation, scope, or any link to a specific incident in the vertical. That does not mean critical vulnerabilities exploited in the region are absent.

Regulation and compliance

The month’s regulatory agenda was most active in Brazil, but its effects can extend to other markets in the region. ANSN’s public consultation on cybersecurity requirements for nuclear and radiological facilities sends a clear signal: the sector is no longer focused only on technical boundaries, but on principles, obligations, and response mechanisms aligned with critical risk management. The start date, September 10, and the publication of the edital in the Diário Oficial da União show that the process has formal backing and is not just a policy statement.

ANEEL’s inclusion in Sisbin carries a different weight. This is not a compliance requirement for private operators, but an institutional decision that strengthens data sharing and cooperation with intelligence. For the power sector, that can translate into better threat anticipation, but also into stricter governance requirements for shared information, coordination channels, and the traceability of sensitive decisions.

The Guardião Cibernético 8.0 exercise follows the same logic of practical compliance. ANSN said it tested prevention, response, and coordinated action in the face of cyber incidents, and CNEN said the goal was to strengthen recovery from incidents that could affect critical infrastructure. That kind of drill leaves a direct lesson for utilities and critical infrastructure operators, preparedness is no longer validated only through written plans, but through multi-stakeholder exercises where coordination failure matters almost as much as technical failure.

In Uruguay, the regulatory dimension is more about citizen prevention and police response to fraud. The UTE case was accompanied by specific recommendations for identity verification and by an official tool from the Ministry of the Interior to validate communications. Even if this is not cybersecurity regulation in the strict sectoral sense, it does show an institutional response aimed at reducing the social engineering attack surface around a utility.

Countries and most affected subsegments

Mexico

Mexico recorded the incident with the highest visible impact on users during the period. The outage in the southeast drew attention because of the number of customers involved, the geographic reach, and public debate over vandalism or sabotage. The available reporting does not support placing that case in confirmed cybersecurity territory, but it does frame it as a high-impact operational crisis for the power sector.

For utility readers, the key point is not just the size of the outage. It is also how the cause became a matter of public dispute. When an interruption affects four states, the narrative around origin and responsibility matters almost as much as restoring service, because it shapes which controls, monitoring measures and communications are activated next.

Brazil

Brazil had the highest density of preventive and regulatory developments. Guardião Cibernético 8.0 brought together energy, water, telecom and defense agencies, and the nuclear sector was explicitly presented as a central training participant. ANEEL joined Sisbin, and ANSN opened a public consultation on nuclear cybersecurity. That mix of exercise, coordination and intelligence suggests stronger institutional maturity than in other Latin American markets in this vertical.

The nuclear subsegment warrants a separate reading. That is true not only because of ANSN and CNEN participation, but also because the exercise included scenarios involving a land-based plant, a hospital, a laboratory and a vessel carrying nuclear material. That places cybersecurity in a hybrid space with physical security, logistics and service continuity. For any critical infrastructure operator, the signal is that planning must already account for cross-dependencies, not just isolated assets.

Cuba

Cuba saw the most severe event for service continuity, with the total collapse of the national power grid. Recovery was partial and slow, with hospitals and essential facilities prioritized and blackouts continuing because of generation shortfalls. The material does not attribute the event to a cyberattack, but it does describe it as a transmission failure with nationwide impact.

From a vertical perspective, Cuba represents the point where the line between an energy crisis and critical infrastructure resilience becomes blurred. A power system that collapses fully or partially forces a reassessment of communication, monitoring and response dependencies. Even without digital attribution, the regional risk reading remains high because it exposes the grid's operational fragility.

Argentina

Argentina contributed a major urban case with the outage in Buenos Aires and about 600,000 customers affected. The cited source pointed to a failure in a system external to the distributor, shifting the analysis toward dependence on shared infrastructure and the need for coordinated continuity among actors. The material shows no evidence of intrusion or a cyber component.

For the distribution subsegment, the case underlines that external systems and operational interconnection can amplify impact even when there is no malicious cause. That puts failover exercises, contingency plans and visibility over suppliers and components that the corporate security team may not always see back at the center.

Venezuela

Venezuela experienced a severe fluctuation in the National Electric System, with voltage drops in Caracas and several states. The material does not provide a closed technical attribution, but it does show a pattern of instability that affects continuity and complicates any causal analysis. In this kind of context, security and operations become tightly linked.

The most prudent reading is to treat the case as an indicator of system fragility and ongoing exposure, not as a cyber incident. Still, from the perspective of a CISO or infrastructure director, the lesson is clear: in volatile supply environments, the ability to maintain visibility, redundancy and prioritization of critical loads is part of the security risk.

Uruguay

Uruguay showed the clearest fraud pattern aimed at a utility. The impersonation of UTE to capture WhatsApp codes affected customer relations and public support more than the power grid. Even so, because it exploits corporate identity, the company becomes central to the problem even if the attack is social rather than technical.

The country also added a more mature discussion of cybercrime overall, with rising complaint figures and the V CIER Symposium on Networks and Smart Cities including cybersecurity in digital power grids and critical infrastructure protection. That suggests the local ecosystem is trying to connect everyday fraud with the broader resilience agenda for the sector.

Trends and signals to watch

The most visible change from the previous month was the sharp drop in ransomware as the dominant theme, from 21 of 52 incidents in the prior month to just 1 of 66 in September. That should not be read as a structural improvement. It points instead to a shift in the available material, where operational continuity, institutional coordination, and disruption events weighed more than confirmed encryption campaigns.

At the same time, the number of unclassified incidents rose from 15 to 23. That increase is not minor. It suggests there are more events affecting the sector that do not reach a closed forensic classification, either because the source does not provide enough evidence or because the event does not fit neatly into the usual categories. For sector intelligence, that means more caution and no assumption that limited visibility equals limited risk.

Documented fraud or phishing cases also increased, from 1 to 2. Even though the absolute number remains low, this type of case is highly sensitive because it exploits utility brands and messaging channels that customers use heavily. This vector deserves attention because it can scale quickly without requiring complex technical exploitation. If a spoofing attempt gains credibility, the reputational impact can grow before any internal alarm does.

Regulatory moves fell slightly, from 3 to 2, but their substance was more meaningful than a procedural formality. ANSN's public consultation and ANEEL's addition to Sisbin point to a more integrated governance model. In other words, there are fewer announcements but more institutional depth, especially in Brazil.

The other signal to watch is the persistence of large-scale power continuity events. Mexico, Cuba, Argentina, and Venezuela show that the vertical remains exposed to disruptions that may have different causes but similar impacts on essential services. For security teams, that means the conversation can no longer stop at the digital perimeter.

Recommendations for security teams

First, separate three classes of events in playbooks: service disruptions, confirmed exfiltration, and mention on a leak site or attribution by third parties. September’s material showed several gray areas, especially at Ecopetrol and in outages in southeastern Mexico. If the team does not classify events correctly from the start, it risks overreacting to noise or underestimating a real intrusion.

Second, strengthen coordination among security, operations, and communications when an outage could be confused with sabotage or a cyber incident. In Mexico, public debate over vandalism and sabotage grew almost in step with the blackout. That requires consistent messaging, spokesperson protocols, and traceability of the technical hypothesis to prevent a provisional cause from becoming the official narrative without support.

Third, review identity verification mechanisms in customer service and support channels. The fraud that used the UTE brand shows that a utility can be abused as a trust anchor even when its systems have not been technically compromised. Staff should be trained not to request or validate codes through unauthorized channels, and simple verification procedures should be published for users.

Fourth, treat interagency exercises as real operational input, not as ceremony. Guardião Cibernético 8.0 left useful signals on coordination across energy, water, telecom, defense, and regulators. Regional teams can use that reference to test cross-dependencies, escalation, recovery, and communications in scenarios that mix IT, OT, and business continuity.

Fifth, keep monitoring OT vulnerabilities and ICS advisories even if the month did not bring a long chain of public exploitation. The material does mention CVEs and an advisory about mySCADA myPRO Manager, and in critical infrastructure, environments with weak authentication or poorly protected privileged functions deserve quick review. The priority is to assess local exposure, not wait for the vulnerability to appear tied to a press incident.

Sixth, build unstable supply scenarios into security planning. Cuba and Venezuela show that a network outage or severe fluctuation can affect monitoring, backups, communications, and recovery. For utilities and critical operators, that means checking power autonomy, contingency routes, telecom backup, and prioritization of essential assets.

Frequently Asked Questions

What changed between September and the previous month in the risk signal for the sector?

The visible pattern changed the most. In September, ransomware lost ground as the primary focus, while unclassified incidents increased, along with operational continuity events and resilience exercises, especially in Brazil. The contrast with the previous month is covered in the Trends and signals to monitor section.

Was there a confirmed cyberattack behind the month’s largest blackouts?

Not in the material reviewed. The outage in southeastern Mexico was linked to vandalism or intentional damage, but there was no cyber confirmation, and Cuba’s collapse was attributed to a transmission failure. Country-by-country detail is in Relevant incidents, and the comparative view is in Countries and subsegments most affected.

What was the strongest fraud signal for utilities?

The impersonation of UTE officials in Uruguay. Police and local media described a scheme to capture WhatsApp codes and then request money from the victim’s contacts. That case connects the Threats and active campaigns section with Countries and subsegments most affected and Recommendations for security teams.

What does Brazil add that other countries did not this month?

It adds the highest level of institutional coordination. ANSN, CNEN, ANEEL, ANA, and the Ministry of Defense converged in Guardião Cibernético 8.0, while ANEEL joined Sisbin and ANSN opened a public consultation on nuclear cybersecurity. The mix of exercises, regulation, and intelligence is analyzed in Regulation and compliance and in Relevant incidents.

Does the mention of two critical CVEs mean there was a wave of exploitation in the region?

Not necessarily. The indicator shows that two critical CVEs were mentioned in the material, but that is not enough to claim a regional exploitation wave or to tie them to a specific incident. In addition, the available material does not allow either case to be developed in technical detail. That is explained in Critical vulnerabilities and in Material limitations.

Material limitations

This report was built exclusively from the material provided for September 2026 and the two prior-month items that reached the archive only as comparative context. The time window for the indicators is limited to 66 dated items from September 2026, plus 2 prior-month items used only for month-over-month contrast. No external sources were added.

A zero indicator, or a lack of technical detail, does not mean the event did not exist in the region. In particular, if a CVE indicator were zero, that would only mean none were recorded in the material reviewed, not that there were no critical vulnerabilities exploited in Latin America. This month the critical CVE indicator was not zero, but the material did not allow for a full exploitation breakdown.

The coverage excluded aggregate telemetry as background signal, and it did not treat attempts, blocks, or automated scans as confirmed incidents. Consumer social media and sponsored or commercial content that is not among the available sources for citation were also left out. When there were allegations of a leak site, data sale, or third-party attribution without corporate or forensic confirmation, they were treated as allegations, not as closed breaches.

Finally, several notes from the period mix operational continuity, energy crisis, alleged sabotage, fraud, and cybersecurity without offering a single causal line. In those cases, the report prioritized the category the material could actually support. If the source did not confirm a cyber component, the event was not artificially elevated to a cybersecurity incident.