Colombia Cybersecurity Update, October 2026

Threats and active campaigns in Colombia

The month left three active fronts that merit separate tracking: ransomware and extortion, fraud or phishing, and intrusion activity with malware in Colombian organizations. The separation matters because the material does not allow a precise mix of what was confirmed encrypted, what was extortion without proven encryption, and what appeared only as a mention on a leak site.

Ransomware and extortion with verified impact

The only case with confirmed encryption and clear operational impact was Colombia’s Ministry of Justice, reported by BlackFog. The source referred to encrypted files, isolated systems, and coordinated recovery. There was no public attribution to a group or reported evidence of exfiltration, so the incident should be read as ransomware with confirmed operational impact, not as simple extortion.

The second tier involves exfiltration without encryption, or with encryption that could not be determined. The material on Nueva EPS did not confirm unauthorized access, but it did record an allegation of data publication and a claim in a forum. Since the entity itself said it had not seen evidence of access to its systems, this should not be elevated to a confirmed incident. For that reason, within the October count, the material remains in the undetermined classification zone.

The third tier covers only a mention on a leak site or ransomware listing. That includes claims such as those involving JHAMF Group and Incomelec on Ransomware.live, but without public confirmation from the companies in the available material. Those records are useful for monitoring, but they do not count as confirmed impact in Colombia.

Fraud and financial phishing

Fraud and phishing were the most common signals of the month. There were campaigns against Bre-B, impersonation of Banco de Bogotá, fake messages through WhatsApp and phone calls, payroll fraud, phishing with sites that mimic banking portals, and an investment scam operation backed by sponsored ads and voice cloning. The common thread was the capture of credentials, verification codes, or financial data.

ShadowParasite fits here as the most structured case. Deepfakes used for financial gain also broadened the social engineering playbook. Not all incidents had confirmed Colombian victims, but they did have impact or a focus on the country. The pattern is consistent with a shift from opportunistic fraud to more industrialized, automated, multichannel campaigns.

The Bre-B case deserves separate reading because the lure did not involve a failure in the payment system, but rather abuse of trust around the registration or transfer process. Several media outlets agreed on that point. The risk is not in the architecture of the payment rail itself, but in using the brand name to induce people to hand over credentials and codes.

APT, intrusion, and malware in Colombian organizations

The October material did not show a state-linked APT campaign conclusively attributed to Colombia, but it did show sustained intrusion and malware activity against local organizations. The judicial campaign with XWorm fits this group, because it combined phishing, persistence, remote access, and potential exfiltration.

There are also secondary signs of activity on Linux servers, such as CL-UNK-1211 reported by Asobancaria’s Financial CSIRT. The source described it as a campaign using SysGoRAT, web shells, and reverse shells against government organizations and state-affiliated infrastructure. It does not attribute the campaign to a specific actor, so the value of the data lies in the technique and the target, not in authorship.

Critical vulnerabilities affecting Colombia

The month’s most significant technical exposure was PHP2Shell. The table below summarizes the vulnerabilities mentioned, the affected software, the exploitation level, and the source supporting it. The table includes only what can be verified from the material provided and does not infer the attack scope in Colombia.

The local reading does not change the central technical fact. ColCERT said 8,699 PHP services were exposed to the internet in Colombia, but that does not mean confirmed compromises. The combination of broad exposure, patch releases, and international validation of active exploitation raises the urgency of patching, temporary isolation, and review of exposed services.

Regulation and compliance in Colombia

October was quieter than September on the regulatory front, but it still delivered useful signals on data governance, digital security, and the use of artificial intelligence. The focus was on a SIC resolution, a district strategy in Bogotá, the AI agenda in health care in the Senate, and an amendment tied to open finance.

The SIC order on ValleCorona is especially significant because it turns an abstract concern about sensitive data into a concrete security and transparency obligation. Bogotá's strategy, in turn, shows a more institutional stance on public-sector cybersecurity, with an explicit role for the District CSIRT and mandatory guidelines.

In health care, debate on Bill 216 advanced with an emphasis on AI governance, clinical validation, traceability, and human oversight. This is not purely a cybersecurity regulation issue, but it is one where cybersecurity, sensitive data, and institutional accountability are closely linked. For compliance teams, that means preparing inventories, data controls, and risk documentation before the rule is finalized.

Most Affected Sectors in Colombia

Banking, fintech, and payments concentrated the heaviest signal density of the month, though they were not the only front. The volume of bank fraud, the impersonation of Bre-B, the ShadowParasite network, and warnings about credentials and verification codes explain why the financial sector was in focus. The risk did not stop at institutions, it extended to users as the final target.

Healthcare also stood out, especially because of Nueva EPS and the regulatory debate around artificial intelligence in the sector. In this case, the signal was not uniform. There were unconfirmed leak allegations, public debate over data protection, and an attempt to structure rules for AI systems. The sector view has to separate rumor, an active investigation, and effective regulation.

The public sector was shaped by two types of events. On one side, the ransomware attack on the Ministry of Justice, with confirmed operational impact. On the other, the exposure of PHP services and Bogotá's effort to institutionalize security policies. That points to a defense agenda that combines operational continuity, technical hardening, and information governance.

Telecommunications and digital infrastructure also entered the picture because of the PHP alert and the state strategy to protect networks, submarine cables, data centers, and satellite stations. Although the number of exposed services does not equal compromise, it does show that the infrastructure layer bears much of the country's risk.

Trends and signals to watch in Colombia

The main trend this month is a shift away from operational incidents and toward fraud, phishing, and critical technical exposure. Compared with September, uncategorized incidents fell from 15 to 4, and ransomware or extortion cases dropped from 13 to 5, while fraud or phishing rose from 3 to 9. That change does not point to relief, but to a redistribution of risk.

The other major signal is the persistence of impersonation campaigns with infrastructure behind them. ShadowParasite was not a simple scam, but a network tied to domains, IPs, and payment gateways. When a fraud case comes with that kind of architecture, the response is no longer only educational and must include takedowns, coordinated blocking, infrastructure analysis, and work with registrars and payment processors.

On the technical front, PHP2Shell added a continuity alert. CISA added it to its KEV catalog, and different sources confirmed active exploitation. For Colombia, that means monitoring updates, reviewing exposure of PHP services, and prioritizing assets in public environments, hosting, and internet service providers. The figure of 8,699 exposed services is a surface map, not a count of compromise.

It is also worth tracking how health care and public administration cases evolve. Nueva EPS did not confirm unauthorized access, but the case showed how sensitive enrollment data is and how easily a post on a forum can trigger a cycle of rumor, verification, and media pressure. At the same time, regulation on AI in health care and on district digital security will require documentation, traceability, and response capabilities that are still not mature in many agencies.

Recommendations for security teams in Colombia

The most urgent priority for October is not just blocking one vector, but addressing three fronts at the same time: technical exposure, identity fraud, and incident response. If a Colombian organization runs PHP services, it should immediately review versions, public exposure, asset inventory, and its containment plan. If it also operates payment or customer service channels, fraud prevention should be treated as a business control, not a side task.

First, patch and reduce the exposed attack surface. Systems running PHP should be moved to the fixed versions identified by CISA and the technical advisories cited in the material. Where immediate updates are not possible, critical services should be isolated, restricted, or taken offline until the gap is closed.

Second, strengthen identity and session controls. The campaigns involving Bre-B, Banco de Bogotá, and other lures show that end users remain the main target. MFA, phishing detection, out-of-band validation, lookalike domain blocking, and brand monitoring should be part of the same program.

Third, review onboarding and document verification processes. Facephi and other coverage this month emphasized the use of AI for account-opening fraud, manipulated selfies, and virtual cameras. For financial institutions and insurers, liveness checks and injection detection are no longer optional improvements.

Fourth, prepare for extortion and data leaks. The Nueva EPS cases and complaints on leak sites show that the response must include evidence preservation, communication criteria, and technical verification before denial or confirmation. A clear protocol prevents an allegation from becoming a reputation crisis because of poor coordination.

Fifth, improve logging and classification. The number of unclassified incidents remains high. That does not mean less activity, only less public precision. If Colombian organizations document more clearly whether there was encryption, exfiltration, extortion, or simple exposure, the country will be able to read its own risk more accurately month by month.

Frequently Asked Questions

What was the difference between the confirmed ransomware case and extortion claims in Colombia this month?

The Ministry of Justice case involved confirmed encryption and operational disruption, according to BlackFog. By contrast, the claims about JHAMF Group, Incomelec, and TECNA ICE appeared as leak-site notices or third-party allegations without public confirmation in the material. The difference is verified impact, not just the threat itself.

What connects PHP2Shell, the public sector, and operator infrastructure in Colombia?

ColCERT’s alert on CVE-2026-109618 and CVE-2026-109619 showed 8,699 exposed PHP services in Colombia, with a large share on operator networks. At the same time, active exploitation was confirmed internationally. That links technical exposure, hosting, and public services, although it does not prove successful intrusion in the country.

How are ShadowParasite and the Bre-B scams related?

ShadowParasite and the fake messages about Bre-B share the logic of impersonation, but ShadowParasite showed a broader infrastructure, with linked domains, IPs, and payment gateways. Bre-B, by contrast, was used as a trust lure to request credentials or codes. Both cases fall under digital fraud, but they are not the same campaign.

What should finance teams prioritize in October?

They should prioritize three things at once, phishing prevention, brand monitoring, and identity verification during customer onboarding. The mix of ShadowParasite, the Bre-B lures, and deepfakes used for financial gain suggests fraud is now operating across multiple channels. The threats and recommendations sections detail the most urgent measures.

What does it mean that the month’s dominant threat was classified as "unclassified"?

It means that, out of 39 verified events in October, 18 could not be cleanly assigned to a single main category. That does not mean there was no risk, only that the available material was limited. The month included signs of fraud, exposure, regulation, and incidents, but many reports did not allow a single threat axis to be identified.

Material limitations

This report covers only facts dated within October 2026 and uses one fact from earlier months only as a comparison point, not as part of the month’s volume. No aggregated telemetry was included, because the material provided did not present it as incident data. Sources excluded by the instructions were also left out, including consumer social networks and publications not listed among the available sources for citation.

When an indicator appears as zero or unavailable, that means it did not appear in the material analyzed for this month, not that the phenomenon does not exist in Colombia or the region. In particular, if a CVE does not appear, that does not mean critical vulnerabilities exploited in the country were absent, only that there is no record of them in the corpus analyzed. In this report, two critical CVEs were in fact mentioned and confirmed.

Telemetry figures, vendor attempts, and blocks are not added to incidents or to confirmed compromises. Likewise, a leak site claim, an exposure alert, or a press note does not by itself equal a verified intrusion. In cases where the material did not allow a distinction between encryption, exfiltration, or a simple mention, that ambiguity was preserved rather than forcing a classification.

Finally, several notes from the month come from secondary coverage or commercial analysis. When a non-primary source provided relevant data, it was used only if the material allowed sufficient corroboration or if the claim remained clearly attributed. Where that was not possible, the report stated so as an assertion that could not be fully verified.