Argentina Cybersecurity Situation, September 2026

Active Threats and Campaigns in Argentina

Ransomware and Extortion in Argentina

Ransomware and extortion dominated the month, with 33 incidents out of 66. The available material points to three distinct layers, but in most cases it did not go far enough to move from allegation to forensic verification. There were three episodes involving exfiltration without encryption, four that appeared only as mentions on leak sites, and 26 cases that could not be classified more precisely with the sources available.

In practice, that means the month was shaped more by public pressure from threat groups than by technical confirmation of encryption or prolonged system outages. Most entries came from leak site monitors, breach aggregators, and third-party reports, with a low level of direct confirmation by audit standards.

Fraud and Phishing in Argentina

No fraud or phishing cases were documented as formal incidents in the period’s indicators, although warnings, behavioral shifts, and analysis of AI-driven banking fraud were widespread. The BCRA warned about fake investment campaigns, while local media detailed scams involving voice cloning, fake advisors, and audiovisual manipulation.

The month’s turning point was not the emergence of a major documented phishing case, but the consolidation of a more industrialized fraud ecosystem. Coverage pointed to recurring identity impersonation tactics, deepfakes, and messages designed to create operational urgency, but that did not translate into a counted case within the formal incident indicator.

APT, Espionage, and Hacktivism in Argentina

APT and espionage activity appeared on two fronts. On one hand, ESET and other analyses reported FamousSparrow activity using a new backdoor against Argentine government entities. On the other, the SparroWocky case reinforced the view that public agencies in the region, including Argentina, remain exposed to campaigns built around persistence and abuse of legitimate services.

The material did not show a wave of hacktivism comparable in volume to ransomware. The pressure here was more technical than narrative, with the focus on backdoors, persistence, and exploitation of edge infrastructure or administrative systems.

Critical vulnerabilities affecting Argentina

The critical vulnerabilities cited this month combine active exploitation, zero-days, and flaws already added to CISA’s KEV catalog. Not all are tied to confirmed local incidents, but the material presents them as part of the risk surface that could affect Argentine organizations.

The table combines vulnerabilities with different levels of connection to Argentina because that is how the source presents them. Some are confirmed by local technical sources, such as MUG Argentina and Gustavo Sied, while others appear in campaign analysis that affected organizations in the country or across the region. In September, the clearest signal was that the edge, management consoles, and internet-exposed products remain a sensitive target for extortion groups.

Regulation and compliance in Argentina

Argentina closed September with an intense wave of regulatory activity, especially in financial fraud, cybercrime, and critical infrastructure protection. Resolution 483/2026 created PRONACIB, a national program to investigate cybercrime and digital evidence, and the Executive Branch sent a national security bill to Congress that adds cybersecurity functions and public and private critical infrastructure.

The BCRA remained the most active player in anti-fraud regulation. Through Communication A 8473, it consolidated a fraud risk score that feeds onboarding, monitoring, and review of instant transfers. The Central Bank also warned about fake investment campaigns and reinforced the idea that public information can help profile risk by person.

At the same time, PRONACIB marked a shift in criminal policy, with a focus on digital evidence, virtual assets, and artificial intelligence applied to investigations. Together, these measures point to a state that is not only seeking to tighten controls, but also to formalize capabilities for incident response and better-supported investigations.

Sectors most affected in Argentina

The sectors most exposed in September were government and defense, education, health, services, technology, and commerce, with industry and finance also appearing. The sector data is not exclusive, since one incident can affect more than one sector, but the distribution does show where pressure was concentrated during the month.

Government and education were at the center of attention because of Argentina's Ministry of Education and the Jujuy Judiciary. Health appeared through Grupo Hospifar and the regional track record that continues to attract extortion groups. Services and technology also showed up in several leak site listings, reinforcing a broad and opportunistic attack pattern.

Finance did not lead the incident count, but it was the sector with the highest density of regulation and warnings. The BCRA, digital wallets, and banks concentrated much of the anti-fraud measures and operational guidance issued during the month. Commerce and retail, with names such as Diarco and Librería Santa Fe, rounded out a sector map that left virtually no vertical with relevant digital data or operations untouched.

Trends and signals to watch in Argentina

September closed with fewer verified incidents than the previous month, but ransomware remained persistent and documented regulatory and fraud activity dropped sharply. Compared with August, verified incidents fell from 84 to 66, unclassified incidents went from 16 to 10, ransomware or extortion cases slipped only slightly from 34 to 33, and fraud or phishing incidents stayed at zero, down from two the month before.

The lower volume does not mean structural relief. In terms of severity, September still showed pressure on sensitive sectors and, in addition, added a more defined regulatory front than August. The month's seven regulatory moves are still far fewer than the fifteen in the prior period, but they point to more concrete institutional action. The most useful reading is that the criminal ecosystem stayed active while the state refined its control and investigative tools.

The quality of confirmation also deserves attention. Only 39% of incidents had direct source confirmation, which means part of the ransomware picture should be treated as public exposure signal rather than a confirmed breach. Next month, case traceability, the release of technical evidence, and the official response from affected organizations will be the difference between a list of claims and a real map of intrusion.

Recommendations for security teams in Argentina

October’s priority should be to tighten controls where September showed the most pressure: immediate transfers, exposed edge services, admin consoles, and digital evidence workflows. The month provided enough material to show that risk is not concentrated in a single sector, but spread across government, education, healthcare, services, and finance.

First, strengthen monitoring for initial access and harden internet-facing assets. Campaigns involving critical CVEs, along with ransomware claims on leak sites, suggest reviewing VPNs, email appliances, admin panels, and any portal with weak authentication or no recent patching. The review should include privileged accounts, phishing-resistant MFA, and alerts for configuration changes.

Second, separate incident response from extortion response. If the organization is named on a leak site, it is not enough to look at the post. Teams need to preserve logs, identify remote access, freeze administrative accounts, verify exfiltration, assess exposed credentials, and coordinate legal and technical response at the same time. If the case involves personal data, the relevant compliance path also needs to be activated.

Third, review the posture against AI-driven fraud. This month’s material showed voice cloning, deepfakes, and adviser impersonation as active tactics. It is advisable to add out-of-band verification, a security phrase for sensitive processes, restrictions on changes to destination accounts, and internal training on signs of audiovisual manipulation.

Fourth, map third-party dependence in critical services. Discussions about critical infrastructure, national security systems, and digital continuity point to supply chain, hosting, cloud providers, and technology operators becoming part of the core risk. Teams should have an updated inventory, RTO and RPO by process, and a continuity plan that does not rely only on the vendor.

Frequently Asked Questions

What changed in Argentina between bank fraud and ransomware this month?

September saw much more pressure from ransomware and extortion than from formally documented fraud or phishing. Fraud showed up mainly in BCRA warnings and coverage of AI, while leak site claims and extortion drove the monthly volume. See also the Threats and Active Campaigns in Argentina and Regulation and Compliance in Argentina sections.

Which Argentine sectors were most exposed to ransomware and new regulation?

Government, education, health, services, technology, commerce, industry and finance each had at least one documented incident. Criminal pressure was most visible in government, education and health, while the heaviest regulatory activity was concentrated in finance and cybercrime. See also Most Affected Sectors in Argentina and Period Indicators in Argentina.

Which critical vulnerabilities should be linked to the month's local cases?

The most relevant were CVE-2026-76461, CVE-2026-85706, CVE-2026-75650 and CVE-2026-59310. Some appear in local technical sources, while others are tied to campaign analysis that affected Argentine or regional organizations. The right reading is to cross-reference them with the type of exposure, not assume automatic local impact. See Critical Vulnerabilities with Impact in Argentina.

Which Argentine regulatory measures carried the most operational weight?

The two most important were Resolution 483/2026, which created PRONACIB, and BCRA Communication A 8473, which established the fraud risk score for instant transfers. Added to that is the national security bill with responsibilities over cybersecurity and critical infrastructure. See Regulation and Compliance in Argentina.

What should a security team prioritize if it appears on a leak site?

Preserve logs, review remote access and privileged accounts, confirm whether exfiltration occurred, cut off compromised credentials, and coordinate technical, legal and compliance response. If the case involves ransomware, it is not advisable to negotiate without minimum forensic verification. See Recommendations for Security Teams in Argentina and Relevant Incidents in Argentina.

Material limitations

This report was built exclusively from the material provided for Argentina in September 2026. There was no internet access or additional external verification, and any facts without a confirmed date were left out. They were not included in the indicators, although they could be used as qualitative context if needed.

A zero value, especially for CVEs, means it did not appear in the material analyzed for the period, not that similar activity did not exist in the region or that exploited vulnerabilities did not occur outside this corpus. Likewise, a zero fraud or phishing indicator does not rule out attempts or incidents in the country, only that they were not documented in this month’s sources with the required classification.

The indicator time window is the one already stated above, 66 dated facts in September 2026, with 2 facts without a confirmed date excluded from the counts. Aggregated telemetry figures, blocked attempts, and vendor averages were also left out of the count because they are not incidents and should not be mixed with the period record.

The material also excluded consumer social media sources and promotional posts as primary evidence. When third-party notes, leak site monitors, or market analyses appeared, they were used only as contextual or attributed signals, never as sufficient confirmation if the material itself did not provide it. That is why several ransomware cases remain in the claim category or have undetermined classification.