Bolivia Cybersecurity Situation, October 2026

Active threats and campaigns in Bolivia

Ransomware and extortion in Bolivia

Ransomware dominated the month, but the material does not support grouping every case under a single impact pattern. In the Solutend case, the source refers to a Panzer claim with alleged exfiltration, although it does not confirm encryption or publish forensic samples. In other mentions from the month, such as Mercantile Investment Corporation Bolivia, the existence of the claim also does not amount to a validated breach.

That distinction matters because the operational risk changes depending on the impact. A simple mention on a leak site can harm reputation and trigger a preventive response, but it does not prove downtime. Exfiltration without encryption, by contrast, creates a different extortion dynamic and a different legal response. The October material mixes both levels and requires each case to be read carefully.

Digital fraud, phishing, and impersonation in Bolivia

The month’s second main theme was digital fraud, with a fairly concrete description of the tactics used against users and financial institutions. Bolivia’s police pointed to links sent through WhatsApp and Telegram, fake bank app updates, voice cloning using artificial intelligence, and threats used to obtain personal data or verification codes. It also warned that criminals can link into mobile banking and carry out unauthorized transfers.

ASFI reinforced that assessment by warning about Alpha Trading FX, a platform that promised high returns and recruited prospects through Facebook before moving the conversation to WhatsApp or Telegram. At the same time, Bolivia Verifica documented an identity theft case on TikTok used to promote a fake electric vehicle offer with advance payments. Although that case is based on a consumer social network, local journalistic verification provides enough support to treat it as documented fraud.

Covert influence and manipulated audio

The digital influence front was also present, although not as a traditional technical breach. OpenAI said it blocked accounts used for covert Russian operations aimed at Latin America, with particular interest in Bolivia and Argentina. CyberScoop and other outlets described an operation called Dark Clark, which used fictional characters, fabricated documents, and audio designed to insert narratives into media coverage and Bolivia’s public conversation.

The material does not show that all of the audio files mentioned were generated by artificial intelligence, nor does it forensically verify every piece. Even so, it makes clear that disinformation was an active vector during October. Bolivia’s prosecutor’s office responded by creating a cybercrime directorate and specialized units to verify audio, communication traceability, and other digital files. That institutional response shows the problem has moved beyond the purely media sphere.

Critical Vulnerabilities with Impact in Bolivia

The month produced one critical vulnerability with clear local impact because of exposure in software used in Bolivian environments. CVE-2026-110447 affected Collabora Online Built-in CODE Server for Nextcloud, and Bolivia's CSIRT issued its own advisory. CISA added it to its catalog of exploited vulnerabilities, Collabora released a fix, and external evidence points to active exploitation during September and October.

The Collabora flaw deserves priority because it is not just an isolated technical alert. The local CSIRT advisory recommended updating to version 26.4.303 or later, or uninstalling the application if it is not in use. The official notice also made clear that disabling the application is not enough as a mitigation. That operational detail matters for administrators who assume simple inactivity of the component means they are protected.

Regulation and compliance in Bolivia

October’s regulatory agenda showed a more active state response to digital violence, privacy, and institutional enforcement. The Chamber of Deputies introduced and pushed forward the Digital Violence Bill, with complaint mechanisms, victim protection, and new offenses such as cyberharassment, cyberstalking, sextortion, and identity theft. The Human Rights Committee also approved bill No. 873/2025-2026, while other outlets reported that it was moving toward the full chamber.

The bill matters because it does not stop at the end user. According to available coverage, it seeks to assign responsibilities to digital service providers and establish response and information mechanisms for authorities. That makes it closer to a compliance framework than to a simple criminal law. Legislative review is still ongoing, so it cannot yet be treated as an active statute.

There were also institutional signals from the Prosecutor’s Office. The creation of a National Cybercrime Directorate and specialized units within the Public Ministry points to stronger investigative capacity for audio files, traceability, and digital records. The acting prosecutor himself acknowledged technical limits for material hosted in the cloud, which suggests a capability gap that the new structure is meant to address.

At the same time, FATF kept Bolivia under enhanced monitoring for money laundering. While that is not a cybersecurity measure in the strict sense, it does affect fraud prevention, financial tracing, and investigative cooperation. In practice, financial compliance and cyber investigations already overlap in the same cases, especially when digital scams, unauthorized transfers, or account misuse are used to move funds.

Most Affected Sectors in Bolivia

Technology, finance, and health accounted for the most visible signal load in October, although not all of the cases were confirmed incidents. Technology concentrated the Solutend case and the debate over vulnerable software, two elements pointing to exposure of infrastructure and data. Finance added Binance, ASFI, the banking sector consulted by Economy, and police alerts about scams, reinforcing sustained pressure on users and institutions.

Health appeared through the allegation against Clínica Foianini, a case that should not be read as a validated breach but as an indication of interest in medical and administrative information. The public sector also featured institutional and regulatory activity, with the Fiscalía and the Cámara de Diputados playing a central role in response and regulation. That distribution shows that risk in Bolivia is not concentrated in a single vertical, although the real weight still tilts toward finance and digital services.

Trends and signals to watch in Bolivia

Compared with September, according to the previous report’s data, this was a lighter month but one more concentrated in ransomware. Verified incidents fell from 79 to 34, while cases involving ransomware or extortion rose from 3 to 10. Unclassified incidents also dropped, from 12 to 2, and regulatory moves declined from 14 to 8. The takeaway is not one of automatic relief, but of a shift in the risk mix.

The main signal to watch is that the drop in volume was not matched by a proportional drop in severity. Ransomware became the leading threat, and the material made pressure on finance and technology more visible again. In September, the prior month was dominated by unclassified events, while in October there was greater clarity about the type of threat, though not necessarily about the final impact.

Fraud shows the same mixed picture. Documented cases fell from 10 to 5, but that does not reduce the urgency. The Police and ASFI described more mature techniques, with AI, impersonation and messaging as the main vector. That points to methods becoming more established, not to the problem disappearing.

Another relevant signal is the convergence between technical incidents and the regulatory response. October brought together a notice about an actively exploited CVE, a legislative agenda on digital violence, and a Prosecutor's Office creating specific units for audio files and cybercrime. That suggests Bolivia's ecosystem is moving from a scattered response toward a partial institutionalization of the response, although gaps in forensic capacity and coordination remain.

Recommendations for security teams in Bolivia

First, prioritize remediation of CVE-2026-110447 in any environment using Collabora Online Built-in CODE Server for Nextcloud. The exposure window was active during September and October, and the local advisory recommends upgrading to 26.4.303 or later, or uninstalling the component if it is not in use. Do not assume that disabling the application is enough as a mitigation.

Second, review fraud controls in mobile banking, messaging, and authentication flows. This month’s material shows that attackers are already combining fake links, identity impersonation, social engineering, voice cloning, and unauthorized transfers. That requires stronger out-of-band verification, alerts for credential changes, and fast lockout procedures for unrecognized transactions.

Third, increase monitoring of leak sites and forums where claims about Bolivian organizations appear. In Solutend, the ransomware signal was not independently confirmed, but it can still trigger reputational risk and secondary extortion. The operational value is not only in final certainty, but in the speed of internal validation and legal response.

Fourth, prepare response playbooks for disinformation and manipulated audio. The prosecutor’s response shows that the issue is already affecting the public agenda and may require authenticity analysis, traceability, and evidence preservation. Communications, legal, and security teams should work together, because the incident no longer ends at the technical perimeter.

Frequently Asked Questions

What combined ransomware, fraud, and regulation in Bolivia this month?

October brought three fronts at once, ransomware as the dominant threat, digital fraud with more sophisticated tactics, and a regulatory package moving forward. The mix appears in the Solutend case, the alerts from the Police and ASFI, and the legislative handling of the digital violence bill.

How is the Solutend case different from a confirmed breach?

Solutend appears in leak site records and in Panzer complaints, but the material does not forensically confirm access, encryption, or verifiable publication of data. For that reason, the report treats it as a sign of ransomware with undetermined classification, unlike a validated incident with technical evidence.

What is the connection between Collabora, the Bolivian CSIRT, and CISA this month?

The three are linked by CVE-2026-110447. Bolivia's CSIRT issued a local advisory, Collabora released the fix, and CISA added the flaw to its catalog of exploited vulnerabilities. Together, those sources show the risk was not theoretical, but active during September and October.

Why do ASFI and the Police appear in the same risk picture?

Because digital fraud in Bolivia combined regulatory warnings with police technical alerts. ASFI warned about Alpha Trading FX, while the Police described fake links, voice cloning with AI, and impersonation through messaging apps. Both point to the same problem, fraudulent collection of money and data.

What should a team operating collaborative software in Bolivia check first?

It should review whether it uses Collabora Online Built-in CODE Server for Nextcloud, verify the installed version, and apply fix 26.4.303 or later. If the component is not in use, the official recommendation is to uninstall it. After that, it is advisable to review logs from September 10, 2026 onward and look for signs of exploitation.

Material limitations

This report was built exclusively from the material provided for October 2026 in Bolivia. No internet sources or outside references beyond the authorized list were used. Facts without a confirmed date were left out of the indicators and were not counted.

The system's aggregate signal modules already exclude telemetry from attempts or blocks, since those are not incidents with confirmed impact.

A zero indicator, or the absence of a category, does not mean there was no activity in the region. It means nothing appeared in the material analyzed for this period. This is especially true for CVEs and for certain sectors, where no record does not equal no real risk. In October, there were also several unverified dark web and leak site signals, which were treated as claims or allegations, not confirmed breaches.

The indicator window was October 2026, and the dataset includes only facts dated within that month. Sources excluded under the methodology included consumer social media posts, sponsored content, and commercial material not suitable as primary evidence. When a claim came only from an attribution or a secondary record, the report applied the corresponding editorial caution.