Bolivia: cybersecurity landscape, July 2026

Relevant incidents in Bolivia

SEPREC and the Krybit case

The strongest episode of the month was SEPREC, the Plurinational Service of Business Registry. Ransomware.live, Galaxy Warden, HookPhish and Darkfield all identified the agency as a Krybit victim on 7 July. DExpose and other analyses added the threat component on the leak site, while Galaxy Warden detailed that internal files were exfiltrated, including company records, owner identities, addresses and corporate documentation. The material does not confirm system encryption, but it does make clear that there was a leak and extortion pressure.

The significance of the case is not only the affected entity. SEPREC holds data of legal and economic value, so an exfiltration can affect both the agency and natural and legal persons that have processed commercial acts. That exposure makes the incident especially sensitive for the public sector and for the business registry and compliance ecosystem.

Digital scam campaign against mobile users

ATT reported that between 1 January and 17 July 2026, the Bloquea la Estafa platform received 16,821 complaints about alleged digital scams, with 13,516 IMEIs blocked and 10,846 lines cut off. That figure should not be read as attack telemetry, but as the volume of complaints and administrative measures. At the same time, FELCC and several media outlets described a consistent pattern of fake apps, sponsored links and trojans that end up accessing mobile banking and credentials.

The material also provides two operational signals. First, the campaign moved with considerable success on Facebook through deceptive advertising. Second, the fraud was not limited to apps, because in Cochabamba a WhatsApp-based variant appeared with fake Transit fines. The combination suggests an adaptable operation, with a low barrier to entry and the ability to keep monetizing through multiple channels.

BGP and the brief route control disruption

Telecom Observer recorded a brief interruption in Bolivia's BGP control plane on 16 July, with route visibility degradation between 17:45 and 18:25 UTC. No public cause or specific operator was identified. The episode is not classified as an intrusion, but as a sign of infrastructure instability that warrants close monitoring because of its potential impact on availability and network observability.

Defacement against a Bolivian state site

Kalir.io reported on 13 July the detection of a defacement on a Bolivian state website attributed to TurkHackTeam. The available material does not allow for much more, since it does not detail the vector, persistence or internal scope. Even so, it adds to the picture of exposed public-facing infrastructure and opportunistic activity against government portals.

Threats and active campaigns in Bolivia

Ransomware and extortion, with shades of impact

In ransomware and extortion, July was not a uniform month. The SEPREC case fits exfiltration with extortion pressure and publication on a leak site. The material on Krybit also describes the group as ransomware-as-a-service with double extortion, Tor-based negotiation and data leakage, and support for multiple platforms. However, in the specific Bolivian case there is no evidence in the material of confirmed asset encryption, so it should be treated as exfiltration with an extortion threat, not as proven encryption.

Another set of incidents fell into the category of being mentioned only on a leak site. That includes references to listed victims, but without enough detail to confirm operational harm. There is also a separate block where the source does not specify whether encryption occurred, which leaves the classification open. That distinction matters, because not every ransomware claim has the same impact on continuity, recovery, or legal exposure.

SEPREC, Krybit and confirmed exfiltration

The technical profile of Krybit published by OT Security Wire and Malware News helps explain the risk in the Bolivian case. The group uses AES-256, RSA-4096, deletes shadow copies with vssadmin, and leaves ransom notes with the .KRYBIT extension. It also operates over Tor and runs a double extortion model. In SEPREC, the most relevant point in the material is the exfiltration of internal files with commercial and administrative data, plus the explicit threat of publication.

Fraud, phishing and identity theft

The digital fraud campaign was probably the most visible signal for everyday users. Urgente.bo reported free applications with computer viruses, Vision360 detailed seven recent cases, La Patria described trojans spread through deceptive advertising, and Red Uno added the use of fake fines via WhatsApp. The pattern is clear, because it combines social engineering, abuse of sponsored distribution, and credential theft, with a focus on mobile banking.

The televised report on the theft of 8.000 bolivianos through computer manipulation fits the same vector. In that case, the attacker installed a trojan that enabled remote access to the banking app. This was not an isolated case, but a concrete example of how a digital scam ends in direct financial fraud.

APT or hacktivism

Based on the available material, there is no sustained APT campaign attributed to a state or proxy actor in Bolivia during July. There was a defacement attributed to TurkHackTeam, which fits opportunistic hacktivism better than persistent intrusion. There were also interpretations involving disinformation and fake content, but that is not enough to classify it as an APT operation.

Critical vulnerabilities affecting Bolivia

July's material gives a very clear picture of Redis. PoCs are circulating, Bolivia's CGII issued a formal alert, and outside technical sources say some initial fixes did not fully close the attack surface. That does not mean Bolivia saw confirmed widespread exploitation, but it does mean exposed Redis services without hardening remain a plausible risk.

Regulation and compliance in Bolivia

Regulation was one of the month’s most active fronts. The government evaluated the possible integration of USDT into the payment system, amid a dollar shortage and a strategy to bring digital assets into the formal banking system. There are still no implementation rules, launch date, provider selection, or declaration of legal tender. This is a technical review stage, not a finalized policy.

The flexible exchange rate regime kept consolidating, with a direct impact on financial and tax operations. Central Bank Resolution 88/2026 and Ministerial Resolution 245/2026 opened the new framework, and the SIN later adjusted invoicing to record the official exchange rate in foreign currency operations. At the same time, the regulatory framework for payroll deductions in the public sector was reorganized through Supreme Decree 5654, with narrower rules and express authorization for voluntary contributions.

There was also movement on access to public information. The Senate approved a bill in general terms, although journalist organizations warned of risks due to the lack of broad public participation. This matters for cybersecurity because greater state transparency is usually accompanied by new obligations for document management, traceability, and data handling.

Another regulatory focus was the national priority against money laundering, aimed at complying with the FATF and exiting the gray list. The material also recalls the enactment of Law 1741 to authorize undercover agents and controlled deliveries in investigations into laundering of illicit gains and terrorist financing. That context helps explain why the discussion about USDT, payments, and financial traceability surfaced so strongly in July.

Most affected sectors in Bolivia

The public sector again sat at the center of the monthly signal. SEPREC holds the clearest extortion case with exfiltration, and the report also picked up references to a defaced state site, regulatory discussions, and agencies that had to respond publicly to security alerts. That does not mean the state was the only affected sector, but it was the most visible in the highest-impact editorial events.

The second most exposed block was telecommunications and connectivity, not because of large-scale attacks but because of a brief BGP disruption and the role of the mobile network in digital scams. The ATT, the FELCC, and the messaging incidents themselves show that the communications layer is critical both for operations and for fraud monetization.

Public health appeared through the alleged leak of the SSSRO system from the Ministry of Health and Sports. That case has not been independently verified, so it should be read with caution. Even so, it points to a type of exposure that in Bolivia is no longer limited to commercial or financial data, but also reaches sensitive personal information tied to health services and training.

Finance and commerce, finally, were affected by several different events. There was mobile banking fraud, debate over USDT, exchange-rate changes, and the SEPREC incident. The combined signal suggests pressure on financial digitization and on the records that support economic formality.

Trends and signals to watch in Bolivia

The month-over-month comparison shows several clear shifts. The most visible was the jump in documented fraud or phishing, from 1 incident in the previous month to 15 in July, an increase of 14. That does not by itself prove a structural deterioration, but it does point to greater public visibility, more reporting, and better identification of impersonation campaigns and mobile trojans.

Regulatory activity also increased, from 9 to 13, with four additional incidents. In Bolivia, that change is not minor, because the agenda around payments, exchange rates, access to information, and financial oversight intersected with practical cybersecurity. The debate over USDT and the official exchange rate widened the area of interest for banks, fintechs, retailers, and compliance teams.

On the technical front, the critical CVEs mentioned went from 0 to 1. Again, that does not mean critical vulnerabilities did not exist in the region before, only that the July material included a specific family with an official Bolivian advisory. The presence of the CGII in that advisory is a useful data point, because it shows the institutional response is monitoring PoC and publishing mitigation recommendations.

The dominant threat shifted from ransomware to unclassified. That likely reflects greater topic diversity rather than improvement. In June, according to the available comparison, ransomware accounted for 13 incidents. In July, the material split across extortion, fraud, regulation, disinformation, infrastructure, and context notes, diluting the dominant theme without reducing the seriousness of the clearest cases.

Security guidance for teams in Bolivia

First, harden any exposed Redis deployment, especially if it uses modules such as RedisTimeSeries or RedisBloom. The CGII warning in Bolivia makes it clear that public exposure and use of RESTORE increase the risk. It is worth reviewing versions, restricting network access, limiting authenticated accounts with restore privileges, and checking whether replication is configured in ways that reduce read-only protection.

Second, treat mobile fraud as an operational threat, not just an end-user problem. This month’s campaigns combine fake apps, sponsored links, WhatsApp messages, and credential theft. Security teams in banking, telecom, and customer support should align blocking, verification, and session revocation messages with simple playbooks, because response speed matters more than retrospective analysis.

Third, review the exposure of public portals and services, especially those containing commerce, health, or citizen-service records. SEPREC showed that extortion can combine data leakage, public pressure, and reputational risk. In that type of case, the priority is not only containment, but also preserving evidence, defining messaging, and confirming whether sensitive data was accessed.

Fourth, strengthen BGP monitoring and connectivity health checks. There was no public attribution for the July event, but route visibility dropped during a brief interval and that justifies observation and escalation rules. Business continuity does not depend only on keeping the service online, but on keeping it routable, observable, and recoverable.

Fifth, maintain coordination among security, legal, and compliance teams on everything related to digital payments and virtual assets. The review of USDT, the new exchange scheme, and invoicing requirements can create process gaps if they are not quickly translated into controls, contracts, claims handling, and transaction traceability.

Material limitations

This report covers only facts dated in July 2026 within the material provided. The four facts from earlier months included as a comparison frame are used only for month-over-month trend analysis and are not part of the period total. No internet was used, and no source outside the authorized list was incorporated.

A zero indicator, especially for critical CVEs, does not mean there were no serious vulnerabilities or exploitation in the region. It means only that none were recorded in this month’s analyzed material. The same applies to any category not observed in the indicators: absence in the document set does not equal real absence in Bolivia.

The 67 percent figure for direct confirmation describes the quality of support for the verified facts, not the full extent of real-world risk. There are also complaints, forum claims, and dark web notes that appear as unverified or are attributed with caution. When a source could not independently corroborate a fact, the text treats it as such.

Consumer social media and sponsored or commercial consumer posts that were not among the permitted sources were excluded from the basis of this report. Aggregated telemetry, such as incidents, blocked attempts, or scans, was also not used as if it were intrusion data. Infrastructure signals and regulatory facts are interpreted as operational context, not as proof of additional attacks.

Technical annex: indicators of compromise and TTPs

The Krybit group, according to OT Security Wire, Malware News and Cyware, operates with a technical chain tied to double extortion, use of Tor for command and control, data transfer and negotiation, deletion of shadow copies with vssadmin.exe delete shadows /all /quiet, and impact on Windows, Linux, VMware ESXi and NAS environments. Its affiliate panels mention typical exfiltration volumes of 10 to 250 GB per victim.

The technical sources also link Krybit to MITRE ATT&CK T1490, T1071, T1105, T1041, T1078 and T1059. In the Bolivian case, these TTPs help frame the threat against SEPREC, although they do not replace local forensic evidence on the exact intrusion, persistence or exfiltration.