Paraguay Cybersecurity Situation, August 2026

Active Threats and Campaigns in Paraguay

Banking fraud and phishing

The most active front in August was banking fraud built on phishing, cloned pages, and credential theft. There were specific cases with high losses, multiple matching accounts about fake home banking, and official alerts on how to respond to suspicious links, emails, and forms. The volume of this trend explains much of the increase in documented incidents compared with July.

The operational takeaway is not that phishing is new, but that this month it was better documented and had a clearer economic impact. The Vallejo case served as the media trigger, but it was not an isolated one. The reports point to a trust impersonation campaign focused on banking and state entities as well.

Hacktivism and DDoS against Paraguayan state sites

In August, claims circulated of DDoS attacks against the Ministry of Foreign Affairs and the National Secretariat of Culture, attributed on social media to the group The Garuda Eye and, in a preventive alert, treated as unconfirmed by the monitoring source itself. There was not enough public evidence to turn those attributions into closed operational incidents, but they did remain as signs of pressure on government portals.

This block sits in a different space from financial fraud. It does not show money theft or confirmed exfiltration, but rather a campaign of political visibility and reputational pressure. From a risk perspective, that requires separating attribution noise on social media from technical confirmation of outage or compromise.

Ransomware and extortion

No typifiable ransomware cases were recorded during the period. There were also no confirmed incidents of extortion with encryption as the primary element, or of exfiltration with simple extortion that could be sustained by the material provided. The only related detail was a contextual reference to cooperatives emerging from a ransomware attack, but the source did not provide enough detail to include it as an incident for the month.

Critical vulnerabilities with impact in Paraguay

August’s material mentioned three critical CVEs, all in products widely used outside the country, but relevant for Paraguayan environments because of technical and institutional exposure. There was no confirmed exploitation in Paraguay based on those advisories, although official and technical references do justify monitoring because of their possible impact on corporate and government networks.

The strongest signal came from Ubiquiti, which published Advisory Bulletin 067 with 22 vulnerabilities in the UniFi family, including three maximum-severity flaws. There were also advisories on Samba and Joomla, but the month’s material did not allow them to be linked to confirmed Paraguayan incidents. Even so, for local teams, these are patches that should not be left out of the remediation cycle.

Regulation and compliance in Paraguay

The month was marked by regulatory expansion on three fronts, personal data, cryptoassets, and cybersecurity. Law No. 7,593/2025 appeared repeatedly in legal and compliance analyses, while DNIT launched General Resolution No. 47/2026 on cryptoasset transactions and Congress kept the Cybersecurity Bill alive. The underlying signal is more regulation, but also more friction over scope, proportionality, and implementation timelines.

Law No. 7,593/2025 was described as inspired by GDPR-type standards and carrying fines that, according to the cited analysis, range from 20 to 2,500 minimum wages, with higher tiers for sensitive data and minors. The key point for August is that the law was still not fully in force, so the operational gap remained open while its practical effects were debated.

DNIT, meanwhile, moved ahead with an annual informational reporting requirement for cryptoassets, with the first filing due in March 2027 and a USD 5,000 threshold for determining who must report. The legal debate was intense. Critics questioned the necessity and proportionality of the requested data, and exchanges asked for a technical working group before the deadline. That makes the measure a cybersecurity and privacy issue, not just a tax one.

At the same time, the Cybersecurity Bill remained under technical and institutional review, with criticism over broad definitions, overlapping concepts, and uncertainty around critical infrastructure. The public hearing ended with another working group, a sign that the text still lacked enough consensus.

Sectors most affected in Paraguay

The financial sector was again the most exposed this month, but not because of a single incident type. It faced account draining, phishing, web banking alerts, cryptocurrency fraud, and regulatory pressure on intermediaries. Traditional banks, cooperatives, and payment services all showed the same pattern, credential abuse and interface spoofing.

The second most affected block was the public sector. Phishing attacks against government portals, claimed DDoS attacks against government sites, data protection debates, and the rollout of tax controls on crypto assets all appeared in the same space. In other words, the attack surface was not limited to banks. It also reached the state as a trust mark and as service infrastructure.

A third front, smaller in volume but strategically important, was telecommunications and corporate systems, with Copaco as the reference case. There were not enough incidents to speak of a systemic crisis in that sector, but there was a fiscal intervention on internal systems that deserves follow-up.

The month’s sector distribution points to a concentration in digital trust rather than in critical infrastructure in the strict sense. The most damaging events for users and organizations relied on deception, site cloning, and credential capture, not on destructive malware or large-scale exploitation of local vulnerabilities.

Trends and signals to watch in Paraguay

Compared with July, three major shifts stand out: fewer unclassified incidents, the disappearance of the ransomware/extortion axis, and a sharp rise in documented fraud and phishing. That shift does not mean the country is "better". It means the visible damage moved toward social engineering, banking fraud, and regulation, with a response agenda that is more dispersed and less centered on a single major incident.

Regulatory activity also rose sharply. It went from 1 documented move in July to 11 in August, focused on personal data, cryptoassets, cybersecurity, and e-commerce. This suggests the state is trying to close gaps, but the open debate over proportionality, jurisdiction, and vacatio legis shows the framework is still not stable.

The dominant threat remained "unclassified," although with one more case than in July. That is not a sign of analytical blind spots, but of a real mix of events that do not fit a single taxonomy. In August there was too much fraud, too much regulation, and too much uncertain attribution to compress the month into one technical category.

For monitoring, three signals deserve attention: whether ransomware cases reappear in cooperatives or critical entities, whether the DNIT adjusts the cryptoassets resolution under operational pressure, and whether the Cybersecurity Law bill adds more precise definitions of critical infrastructure and institutional authority. The month made clear that the cost of regulatory disorganization quickly reaches end users and the financial sector.

Recommendations for security teams in Paraguay

Review authentication and anti-phishing controls in web banking and customer service portals, with emphasis on cloned-site detection, domain validation, and hardening of secondary screens or token flows. The month’s cases show that impersonated interfaces were the dominant vector, not brute force.

Tighten fraud response with simple, public procedures: immediate account blocking, a single reporting channel, evidence preservation, and coordination with Policía, Fiscalía and CERT-PY. At the same time, train users and operators to recognize emails, SMS messages, and forms that mimic the State or a financial institution.

Prioritize patches in environments with Ubiquiti, Samba and Joomla, especially if remote administration is exposed or they are used in corporate and government networks. Although the material did not confirm exploitation in Paraguay, the advisories published in August were severe enough to enter the maintenance cycle without delay.

Review how data collected under tax and regulatory obligations is handled, especially in cryptoassets. The debate over necessity and proportionality is not abstract, it affects operators, exchanges, and legal teams, and it can ultimately affect data architecture, retention, and traceability.

Frequently Asked Questions

What changed in Paraguay between August and July 2026?

August had fewer unclassified incidents, dropping from 15 to 11, and the primary ransomware signal that appeared in July disappeared. At the same time, fraud and phishing rose from 0 to 11, and regulatory activity increased from 1 to 11. The shift is discussed in the Indicators and Trends sections.

Did the month show confirmed ransomware in Paraguay?

No. The August material did not allow any ransomware or extortion case to be classified as a primary theme. There was a contextual mention of cooperatives emerging from a ransomware attack, but it was not enough to include it as a verifiable incident for the period. That distinction is developed in Active Threats and Campaigns and in Material Limitations.

What risk was most visible for Paraguayan banks and users?

Phishing fraud and web banking impersonation. The Vallejo case, the entrepreneur who lost 43 million, and the alerts about cloned sites point to a pattern of credential theft and account draining. The operational reading is covered in Relevant Incidents, Active Threats, and Most Affected Sectors.

What is the relationship between the personal data law and the cryptoassets resolution?

Law No. 7.593/2025 establishes a data protection framework that is not yet fully in force, while DNIT has required an informative declaration of cryptoasset operations since August 2026. Together, these measures push organizations to review proportionality, minimization, and data traceability. That is addressed in Regulation and Compliance.

What vulnerabilities should Paraguayan teams watch, even without confirmed local exploitation?

The three critical Ubiquiti-linked CVEs, CVE-2026-77537, CVE-2026-77550, and CVE-2026-77554, because they allow unauthenticated remote execution or authentication bypass. Teams should also monitor the alerts affecting Samba and Joomla. The technical table is in the Critical Vulnerabilities with Impact in Paraguay section.

Which sectors were most exposed in August?

Mainly financial services, because of the concentration of fraud, phishing, and account draining, and the public sector, because of portal impersonation alerts, claimed DDoS activity, and new regulations. A third front was telecommunications and corporate systems, with the Copaco case. The analysis appears in Most Affected Sectors in Paraguay.

Material limitations

This report was built exclusively from the dated facts from August 2026 included in the provided material. The indicators reflect that time window and do not include aggregated telemetry, blocked attempts, or external signals not documented in the corpus.

A zero value, especially for CVEs or ransomware, means that no typifiable case appeared in the material analyzed for this period, not that there was no activity in Paraguay or the region. That distinction is key to reading the indicators correctly and avoiding improper extrapolations.

Uncorroborated social media posts, sponsored content, and any material not included in the list of permitted sources were excluded as evidence. The report also avoided treating as established fact anything that the sources themselves framed as a hypothesis, unconfirmed attribution, or preventive alert.