Colombia Cybersecurity Situation, August 2026

Threats and active campaigns in Colombia

Ransomware in Colombia: confirmed encryption, partial exfiltration, and multiple uncategorized mentions

August was dominated by ransomware, but the material does not support treating the entire signal as a single type of impact. There were 5 cases with confirmed asset encryption, 2 with exfiltration without encryption, 2 that appeared only on a leak site, and 57 where the type could not be established with precision.

The Ministry of Justice falls into the first group. There, files were encrypted, services were degraded, and containment measures were taken, although there was no public proof of data theft. At the same time, the PIO PIO case attributed to Majinahanashi appears as an exfiltration with a threat to leak data, and the AuditTeam entry on a financial institution remains at the level of a leak site mention.

The operational takeaway is more useful than the broad label. In Colombia, August ransomware combined real operational disruption with several levels of extortion pressure, and the available material does not justify counting all of it as the same thing. Attribution also remained open in several cases.

Fraud and phishing in Colombia: bank impersonation, fake messages, and deceptive calls

Digital fraud became denser and more visible, with 12 documented incidents in August. The tactics included messages about a "pending payment" or "pending transfer," fake banking security assistants, emails with court summons or fines, calls from supposed bank officials, and fake donation campaigns after the earthquake.

The clearest cases were concentrated in banking and payments. Bogotá issued alerts about impersonation of Bre-B, the mayor's office warned about fake virtual assistants, and El Colombiano documented banking scams involving supposed security accounts and loans arranged with upfront payments. There were also alerts about fake subsidies from the Registraduría and fraudulent donations.

The month points to a simple pattern. Attackers exploited moments of urgency, customer migrations, process changes, and confusing service channels. That means fraud depends not only on volume, but also on timing and context.

Campaigns and technical exploitation in Colombia: the APT or persistent intrusion signal remained limited

Beyond ransomware and fraud, the month also left a technical signal in vulnerabilities and intrusion campaigns, although without a robust body of facts that would support speaking of a Colombia-focused APT. The SharePoint alert and reports on cPanel/WHM showed a significant risk surface for hosting, SaaS, and shared infrastructure.

The StrikeShark campaign also surfaced, identified by Kaspersky and cited in regional material, which included Colombia among the affected countries. However, the available material does not provide a verified local victim in this period or enough detail to classify it as a fully characterized Colombian campaign.

Critical vulnerabilities affecting Colombia

The table brings together the critical identifiers mentioned in this month’s material, but only one is directly tied to a formal Colombian alert, the SharePoint one. The others provide regional exposure context and patch-hardening guidance, not confirmed local incidents.

Regulation and compliance in Colombia

Colombia ended August with an active regulatory front, although more concentrated than in July. There were six documented moves, down from eighteen the month before, with priority given to relief for financial consumers, digital identity, AI, personal data, and the organization of open finance.

The Financial Superintendency was the most visible agency of the month. It stepped up support for consumers affected by the disaster, published External Circular 007 with deadline limits for refinancing, and kept the "Quejas exprés" complaint system in place. That is not pure cybersecurity, but it is part of the broader digital financial resilience environment.

On personal data, the SIC kept its focus on the RNBD and on the processing of biometrics. The closure order against World Foundation and Tools for Humanity, together with alerts about iris data and impersonation, showed that the regulatory debate is no longer centered only on consent. It is now also about the effective deletion of sensitive data and technical proof of compliance.

In AI, the month left a regulatory framework still under construction, with bill proposals, criticism over how workable the rules may be, and debate over algorithmic surveillance, biometrics, and automated decisions. The field is not settled, but it is becoming a compliance vector that is starting to intersect with fraud, identity, and model audits.

Most Affected Sectors in Colombia

The public sector was the main target in August, with the Ministry of Justice as the central incident and additional signs of impact on public safety, service continuity, and records management. The disruption was not only technical, but administrative as well, with requests being rerouted, alternate channels activated, and case histories rebuilt.

Banking and financial services were the second major focus, not because of a large intrusion incident, but because of the volume of fraud. Alerts about bank impersonation, Bre-B, fake assistants, and customer migrations point to a heavily exploited risk surface, where social engineering remains more profitable than complex technical exploitation.

Telecommunications and digital infrastructure produced two kinds of signal. One was about continuity, with Movistar’s widespread outage and the CRC warning about possible disruptions for smaller ISPs. The other was technical, with the BGP alert and the critical vulnerability in cPanel/WHM, which affect the core of connectivity and hosting.

Regulatory and data protection activity also appeared, especially in supervised entities, fintech, and biometric processing. The mix of sectors is not accidental, the month showed that risk in Colombia crosses documents, identity, payments, connectivity, and government services with far less separation than is often assumed.

Trends and signals to watch in Colombia

The clearest shift from the previous month was the jump in ransomware and fraud. Ransomware rose from 30 cases in July to 66 in August, while fraud and phishing increased from 1 to 12. Regulatory activity, by contrast, fell from 18 to 6, suggesting the month was driven more by incidents and campaigns than by new rules.

The comparison also shows that the country did not change its risk map, only its intensity. The same sectors remained in play, but the public sector was hit harder and the financial system faced more fraud attempts. At the same time, the mention of just one critical CVE does not reduce the technical risk, because August did show active exploitation in widely deployed infrastructure.

Another signal to watch is the coexistence of recovery and exposure. MinJusticia kept restoring services, but alerts around identity, biometric data, open finance, and platform exploitation continued. That makes resilience a process issue, not just a perimeter issue.

August also left a warning about third-party dependence. The Ministry of Justice case involved Microsoft’s DART team and the IDB in recovery efforts, while telecom and hosting cases raised risks tied to smaller vendors, shared infrastructure, and exposed control panels. That is the kind of attack surface that grows fastest when digitalization outpaces operational maturity.

Security recommendations for teams in Colombia

First, review exposure from remote services and the hygiene of privileged accounts. This month showed that ransomware still gets in through credentials, exposed access, and remote administration platforms. Phishing-resistant MFA, closing unnecessary RDP, and real segmentation are not optional.

Second, strengthen controls over email, SMS, calls, and messaging. Fraud campaigns exploited bank impersonation, pending payment messages, fake assistants, and court summons. It makes sense to tighten filters, detect lookalike domains, enable out-of-band validation, and train users with local examples, not generic ones.

Third, protect sensitive and biometric data with a focus on traceability. The iris case in Cartagena, the debate about the SIC, and digital identity obligations point to a problem that does not end with collecting data. Organizations must be able to prove why it was collected, who accessed it, when it was deleted, and how they respond to a complaint.

Fourth, prepare continuity plans specific to document systems and citizen services. MinJusticia showed that a down SGDEA can force teams to rebuild case files, reopen manual workflows, and keep service running through alternate channels. Business continuity plans should account for that kind of degradation, not just a total site outage.

Fifth, prioritize patching hosting panels, SharePoint, and edge components. Alerts on CVE-2026-50522 and CVE-2026-65643 confirm that a well-placed vulnerability can become a critical entry point. If a public service or a third-party provider depends on those products, the exposure window should be treated as urgent.

Frequently Asked Questions

What explains why August saw more ransomware and less regulation in Colombia?

August was dominated by a major ransomware case at the Ministry of Justice and several related campaigns and reports, while regulatory output fell compared with July. The comparison between the two sections shows more operational pressure and less regulatory activity, although digital identity, data, and open finance remained on the agenda.

What is the difference between confirmed ransomware cases and mentions on a leak site?

In August there were 5 cases with confirmed encryption, 2 with exfiltration without encryption, and 2 mentioned only on a leak site. That distinction matters because a leak site by itself does not prove operational impact or verifiable exfiltration. The threat and incident sections separate those levels so extortion is not confused with real disruption.

How are the Ministry of Justice case and the SharePoint alert in Colombia connected?

They are connected by technical surface and timing. The Ministry of Justice suffered ransomware with degraded services, while COLCERT issued an alert about SharePoint Server and international reporting pointed to active exploitation of a critical flaw. The vulnerabilities table and the incidents table show that both issues occurred in the same month.

Which sectors should security teams in Colombia watch most closely?

The public sector, because of the direct impact of ransomware at MinJusticia, and the financial sector, because of the rise in banking fraud and Bre-B impersonation. Telecommunications, hosting, and digital services also need attention, because the month raised signals about continuity, BGP, control panels, and exposed providers.

What concrete controls became more urgent after August?

Phishing-resistant MFA, shutting down unnecessary remote access, rapid patching for SharePoint and cPanel/WHM, monitoring for banking impersonation in SMS and calls, and continuity plans for SGDEA and other document systems. Those priorities come from the incidents, threats, vulnerabilities, and recommendations sections.

Does the indicator of a single critical CVE mean there were no other serious vulnerabilities in the region?

No. It means that in the material analyzed for Colombia during August, only one critical CVE was recorded within the scope of the report. The limitations section makes clear that a low or zero value in an indicator does not mean there was no regional risk, only that no verified records were found in this corpus.

Material limitations

The report was built exclusively from the facts provided for Colombia in August 2026, plus one fact from earlier months used only as a comparison point. The time window for the indicators was the one stated at the start, with 122 facts dated in August, 1 from earlier months used only for comparison, and 2 without a confirmed date excluded from the counts.

An indicator at 0 or without a breakdown, especially for CVEs, does not mean there were no vulnerabilities or exploitation in the region. It means that data point was not recorded in the material analyzed for this period. The same applies to categories where the material did not allow confirmation of whether there was encryption, exfiltration, or only a mention on a leak site.

The analysis did not include aggregated telemetry such as the volume of blocked attempts, because the material did not provide figures of that kind. Nor were trends based solely on sponsored content, commercial releases, or consumer publications without primary corroboration used as support.

Facts without a confirmed date and any material not included in the list of available sources to cite were left out of the indicators. References to social media, when they appeared in the file, were used only if the fact was also supported by a permitted and verifiable source within the corpus.