Situación Nacional de Ciberseguridad - Junio 2026 - Bolivia

Threats and active campaigns in Bolivia

Ransomware and extortion

Ransomware and extortion dominated the month. The evidence points to more than one group and combines infrastructure activity, defensive analysis of backup-oriented products, and campaign reporting on Silent Ransom Group and INC Ransomware. In SRG's case, the operation relies on a Fast Flux network with nodes in Latin America and a presence in Bolivia, widening the group's regional footprint.

According to SOC Prime, INC Ransomware evolved into a RaaS model with Rust encryptors, double extortion, and attacks aimed at backup servers. That detail matters in the Bolivian context because it connects to the pressure seen against the backup layer and to the need to protect credentials, repositories, and admin consoles.

Fraud and phishing

This month's corpus includes only one documented fraud or phishing case, so this category had a smaller presence than extortion. The material does not provide enough evidence to build a robust national phishing campaign, or to confidently tie it to a specific sector.

APT and hacktivism

No verifiable incidents were established that would support describing an APT or hacktivist campaign in Bolivia during June 2026. The absence of that axis in the material does not mean the risk is absent, but it does mean the month was dominated by extortion, availability impact, and tighter regulation.

Critical vulnerabilities with impact in Bolivia

No critical CVEs were identified in the material for this period.

Regulation and compliance in Bolivia

June was busy on regulation and compliance. The country logged 9 documented regulatory moves, with signals in health, finance, state planning, and artificial intelligence. This was not a single policy track, but several layers converging on technology governance, information security, and control over the use of automated systems.

The broadest item was the draft Artificial Intelligence law. According to Bemorex, the text bans the collection and mass use of facial biometric data without judicial authorization through habeas data, limits the use of AI to exploit vulnerabilities tied to age, disability, or socioeconomic status, and prohibits deepfakes or synthetic content that harms honor, democratic processes, or collective rights. It also recognizes rights for individuals, including not being subject to exclusively automated decisions when subjective rights are affected and having access to clear information about the use of AI.

That same draft sets a requirement for a Special Personal Data Protection Law within 180 days after its enactment. For Bolivia, that points to a shift from scattered rules toward a more structured data processing framework, with direct impact on public and private providers.

In parallel, the Ministry of Development Planning and Environment reported strategic bases for digital transformation with prioritized regulatory guidelines, operational technological innovation, and consolidated interinstitutional coordination. In practical terms, the Bolivian state is pushing a digitalization agenda that can no longer be separated from cybersecurity.

ASFI also sent concrete signals. A report on Valores Unión SA Agencia de Bolsa included approval of a technological security management policy, while its circulars recorded an entry on changes to the compilation of rules for services and information security. The regulatory message is consistent with the rest of the month, more controls, more formalization, and more pressure on compliance in regulated sectors.

Public health was also affected. AGEMED confirmed the security incident and the Ministry of Health reported 668 measles cases accumulated since April 2025, which is not a cyber event itself, but does underscore that the continuity of health services and the ability to communicate institutionally remain critical. In a month with high operational sensitivity, the resilience of health digital infrastructure is not a secondary detail.

Sectors Most Affected in Bolivia

The consolidated material shows activity across 6 sectors, with a heavy concentration in health, finance, government, technology, telecommunications, and the education or training environment tied to security. The sectors do not carry the same weight, but the pattern is consistent enough to avoid reading this as a story about a single domain.

Health was one of the most sensitive areas because of the AGEMED case. The impact there was not hypothetical or reputational, it involved unauthorized access, deletion of information, and service disruptions. For an agency of that kind, system availability and data integrity have a direct effect on care delivery and administrative management.

Finance produced more of a regulatory signal than an incident, but it is still significant. ASFI pushed changes to technology security management policies and information security standards, which indicates that Bolivia’s financial system is facing closer regulatory scrutiny. That usually points to stronger demands for traceability, response, and third-party control.

Government and public administration appear through both AGEMED and the Ministry of Planning report. Together, they show a clear picture, the state is digitizing, but it also has to respond to incidents that affect services and to legal frameworks that are still being built. Security maturity is becoming a condition for digital transformation to avoid becoming brittle.

In technology and backup, Veeam stood out as a defensive reference. Although it is not a Bolivian company, the material was explicitly aimed at companies in Bolivia and Latin American channels. The focus on cyber-resilient backup, online entropy, and integration with security platforms reflects a market that already recognizes the need to protect the recovery layer.

Telecommunications and connectivity appear indirectly but importantly through the geolocated node in La Paz associated with Telefónica Bolivia within the infrastructure of Silent Ransom Group. That does not imply the company is responsible for criminal activity, but it does show that local networks can be absorbed into botnet structures and distributed extortion.

Trends and signals to watch in Bolivia

There is no comparable baseline available, because this is the first archived period with this indicator format for Bolivia. For that reason, it does not make sense to force a trend against the previous month. The reading has to be made within the month itself.

The first signal to watch is how extortion is evolving. With 13 documented incidents, this threat outweighs the rest of the corpus and lines up with campaigns where the goal is not only to encrypt, but to paralyze or pressure through credentials, backup access and data exposure. If June showed anything, it was that extortion found clear leverage points in backup infrastructure and sensitive services.

The second signal is data and AI governance. Bolivia's bill already sets concrete limits on biometrics, deepfakes and automated decisions. That forces legal, compliance and security teams to review data inventories, model use, consent traceability and retention. This is not a future debate, it is a regulatory agenda already underway.

The third signal is the health of backup systems. The presence of Veeam in several pieces of the corpus, from technical defense to the Akira 3 analysis, confirms that the recovery layer is at the center of the problem. It is worth monitoring authentication, credential segregation, immutability, isolated copies and detection telemetry, because that will be one of the preferred targets.

The fourth signal is the relationship between digital transformation and institutional security. The Bolivian state reports regulatory and operational progress, but the AGEMED incident shows that digitizing without strengthening resilience leaves both services and data exposed. Operational continuity should be read as part of the modernization process itself, not as an add-on.

Security recommendations for teams in Bolivia

First, treat the backup architecture like a frontline asset. The attacks reviewed in the source show that credentials, consoles, and backup repositories become priority targets. Privileges need to be limited, administrative accounts separated, immutability enabled where possible, and restores verified regularly from isolated copies.

Second, strengthen early detection across backups and storage. Online entropy capabilities, IoC scanning, and MITRE ATT&CK correlation point to a practical approach, detecting anomalies before a backup finishes or before a malicious session completes its path. If the backup is already encrypted or altered, the response window shrinks sharply.

Third, review exposure in public and regulated services. AGEMED and ASFI show that health care and finance remain sectors that combine operational criticality, regulatory demands, and incident exposure. Access controls, event logging, segmentation, and recovery procedures should be audited more often than usual.

Fourth, prepare compliance for the new AI and data environment. If the Bolivian bill moves forward, organizations will need to document AI uses, identify automated decisions, control biometrics, and plan responses to right-to-be-forgotten or remediation requests. Security, legal, and privacy teams will need to work from the same inventory.

Fifth, treat home and peripheral connectivity infrastructure as part of the expanded perimeter. The infected residential nodes linked to Silent Ransom Group show that botnets and extortion do not rely only on servers. Response teams should account for telemetry, cleanup campaigns, and coordination with providers when the local network is being used involuntarily.

Material limitations

The report was built exclusively from the material provided for June 2026 and from direct source confirmation for the consolidated facts. No external searches or sources outside the permitted list were used.

The monthly comparison could not be developed because this file contains no prior baseline for Bolivia in the same indicator format. For that reason, trends are interpreted within the period itself, not against the previous month.

No critical CVEs were identified in the corpus. The corresponding table remains substantively empty because that was the actual state of the available evidence.

Social media and forum leads were not included as facts, even though they helped guide the preliminary search, because they did not meet the confirmation standard required for this report.