Situación Nacional de Ciberseguridad - Julio 2026 - Uruguay

Threats and active campaigns in Uruguay

Ransomware and extortion in Uruguay, ACU, and leak site cases

Confirmed asset encryption, ACU and Deadlock

The month’s strongest ransomware case is ACU, the Automobile Club del Uruguay, listed by Deadlock on ransomware.live, with discovery dated July 10. The associated intelligence source and follow-up coverage indicate that exfiltration took place before encryption. In this case, the operational impact was not limited to a mention on a leak site. The appearance on the victim portal and the actor’s description point to an intrusion involving double extortion techniques.

Exfiltration without encryption, BHU as a materialized extortion case

Banco Hipotecario del Uruguay appears in July as the clearest example of exfiltration with material impact. Sources describe information theft, a ransom demand, and the later publication of material on the dark web after payment was not made. The incident was attributed by the press to the Crypto24 group. Although the original date of the attack is October 2025, the persistence of its effects in July 2026 justifies its inclusion in the qualitative part of the report, not in this month’s incident base. For taxonomy purposes, what can be verified is exfiltration and extortion, with damage that continued over time.

Leak site only, Section9 and an unconfirmed Uruguayan entity

In July, several monitoring services placed a Uruguayan entity, with the domain hidden in the material, in connection with the Section9 group. Breach House, Recentbreaches, Darkfield, GalaxyWarden, and Dexpose all placed the case on July 26 or 27 and mentioned exfiltration or a publication threat, but there was no public confirmation of the affected organization and not enough precision to say with confidence whether encryption occurred. For that reason, the case should remain in the leak site mention category or undetermined classification, depending on the source consulted.

Fraud and phishing in Uruguay

Financial deepfakes using the president’s image

The Revelum report cited by Nación.com.uy is the clearest fraud case of the month. This is not classic email phishing, but fraudulent ads using deepfakes of a public figure to induce investment or divert money. The case shows an evolution in deception, more visual, more convincing, and with high segmentation potential. The most striking detail is the rapid pace over just a few days, with 16 ads detected between July 21 and 23.

Warning on poorly designed automations and AI

El País Uruguay and El Correo do not report a concrete fraud operation involving a specific organization in the country, but they do highlight a concern that became part of the local debate in July, AI systems and automations performing broader actions than intended because of design problems. This does not count as a fraud incident, but it does add context for future abuse of automation and privilege escalation campaigns.

APT, hacktivism, and opportunistic campaigns in Uruguay

The July material does not show strong evidence to attribute a classic APT campaign against Uruguay. What does appear is opportunistic, large-scale activity, with exploitation of vulnerable sites and leak sites used to increase pressure on victims. The campaign involving sites from Hospital de Clínicas and INISA fits better as automated exploitation than as a persistent actor with strategic objectives. That distinction matters because it changes the needed containment approach, from hardening exposure and patching to reviewing credentials, logs, and persistence mechanisms.

Critical vulnerabilities affecting Uruguay

The vulnerability agenda dominated the month and was backed by local and external sources. CERTuy was the most relevant actor for Uruguay, because it not only circulated Microsoft’s advisory but also issued its own alert on Joomla. That was joined by advisories from other response teams that help frame the severity of the exposure.

These flaws point to two clear takeaways for Uruguay. First, Windows environments and Microsoft 365 or SharePoint remain a high-value attack surface for opportunistic and advanced threat actors. Second, CMS platforms and third-party extensions, especially Joomla, remain a classic weak point in institutions that manage public or semi-public sites with irregular update cycles.

Regulation and compliance in Uruguay

July was a particularly active month for regulation. The Central Bank of Uruguay approved a specific framework for Virtual Asset Service Providers, with requirements for authorization, corporate governance, compliance, auditing, and information security. The regulatory package includes the need to appoint independent officers outside the technology area, conduct annual external audits on service continuity and cyberattack resilience, and meet additional operational and user protection obligations. Different media outlets summarized the rule from complementary angles, but the core is the same, more oversight, more segregation, more control.

For Electronic Money Issuing Institutions, starting on July 1, 2026, they must periodically report their cybersecurity capabilities to the BCU. This is an important shift because it turns cybersecurity into regulatory supervision data, not just an internal practice. The message is clear, the regulator wants comparable data and a baseline of resilience across the financial system.

Decree No. 168/026, approved on July 17 and officially published on the 30th, completes the picture from the state side. The measure requires the Central Administration to activate administrative procedures immediately after incidents, and sets consequences if problems are linked to lack of foresight, inadequate processes, or outdated systems. The logic is institutional maturity, although its effectiveness will depend on actual implementation, internal timelines, and AGESIC’s ability to support and supervise.

Sectors most affected in Uruguay

The sectors most affected by July's activity were public sector, financial services, technology, transportation, and food and services. This distribution should be read as overlap, not as separate silos. The same incident can affect more than one sector, for example, a breach at a financial institution carries regulatory, reputational, and operational impact at the same time.

The public sector faced two kinds of pressure. On one hand, direct impact on the websites of institutions such as Hospital de Clínicas and INISA, with an automated pattern of vulnerability scanning. On the other, the regulatory shift driven by Decreto N.º 168/026 and the Rendición de Cuentas bill, which requires annual cybersecurity reports. That dual move, incident plus regulation, suggests Uruguay's public sector came under pressure from both technical exposure and administrative demands.

The financial sector appeared on several fronts. BHU continued to show the effects of a major attack with a large-scale leak, while the BCU tightened the framework for PSAV and IEDE. The contrast is telling. The regulator recognized that the attack surface is no longer limited to traditional banking, but also includes cryptoasset and electronic money ecosystems. In practice, operational risk and compliance risk became much more closely tied.

In transportation and automotive services, ACU appeared as a victim linked to Deadlock. In food and services, the case tied to Section9 showed that ransomware actors are still targeting organizations with operational and reputational value. Finally, the deepfake fraud block overlaps with the financial sector, although the abuse itself stems from the use of a political identity and not from a specific financial platform.

Trends and signals to watch in Uruguay

There is no formal comparative baseline available for this country, because this is the first archived period with this indicator format. For that reason, no monthly change against June should be inferred. Even so, July does surface several signals worth tracking.

The first is the dominance of vulnerabilities. If 18 of the month’s 72 verified events fall into this category, the message is that Uruguay remains highly exposed to patch cycles from major vendors and to flaws in widely used software, especially Microsoft and third-party CMS platforms. The Joomla case and the Microsoft package show that the window between disclosure and exploitation remains very short.

The second is the consolidation of extortion as a pressure tactic, beyond encryption. In July, one confirmed encryption case, one exfiltration and ransom case, and several appearances on leak sites with incomplete classification coexisted. This suggests operators still value data publication, even when they do not achieve full technical impact on the infrastructure.

The third is the institutionalization of response. Uruguay is moving from issuing alerts and documenting incidents to demanding reports, audits, and formal accountability. The BCU and AGESIC are pushing in that direction. It remains to be seen whether agencies and operators turn that regulatory pressure into practical changes in inventory, patching, privilege segregation, and operational continuity.

The fourth is the growth of synthetic fraud. The deepfakes of Yamandú Orsi are a warning about social engineering campaigns that are more convincing and harder to stop with traditional controls. If material of that kind circulated widely in July, more attempts to abuse public or corporate identity are likely in the months ahead.

Security recommendations for teams in Uruguay

Prioritize remediation of the components cited by CERTuy, especially the vulnerabilities actively being exploited in Active Directory Federation Services, SharePoint Server and SP Page Builder for Joomla. If there is public exposure, response time should be measured in hours, not days. In Microsoft environments, also review coverage of the rest of the July patch set, because the local advisory highlights a much broader attack surface than the zero-days.

Review the inventory and exposure of CMS platforms, extensions and plugins. The campaign against Joomla and the description of the mass defacement of Uruguayan sites show that public-facing pages remain an easy target when the update cycle falls behind. Manual verification that patches were actually applied, rotation of administrative credentials and review of privileged accounts remain basic measures that cannot be left to platform inertia.

In the financial sector and among virtual asset providers, align regulatory obligations with technical controls. The new BCU framework should not be treated as a paperwork exercise. Requiring an independent security lead, external audits and evidence of resilience against cyberattacks forces organizations to organize records, continuity, fund segregation and incident response. If that documentation does not translate into real tests, drills and internal metrics, compliance will be fragile.

In public agencies, formalize incident response under Decreto N.º 168/026. That means clear escalation paths, designated owners, criteria for reporting to AGESIC and traceability for remediation efforts. It also makes sense to review institutional websites exposed to the internet, because the mass attack against public pages showed that the risk does not always come from a sophisticated intrusion, but from low-cost automation against poorly maintained attack surfaces.

Strengthen anti-fraud controls for synthetic media and impersonation campaigns. The Yamandú Orsi deepfakes show that visual verification is no longer enough. Security and communications teams should define procedures for public alerts, ad takedowns, brand monitoring and out-of-band confirmation when suspicious audio or video pieces appear.

Technical appendix: indicators of compromise and TTPs

Section9 and Deadlock, domains and observable footprints

July material includes at least one explicit IOC in the Section9 case. ransomware.live publishes for the Section9 group the compromise identifier 0CB7BEB4F390737D72070C4DAD8C1516A962C333DE7668ACA379CAA0DD7F1277CB6703B746B4, tied to its communications infrastructure. This data is useful for detecting contacts or infrastructure linked to the operator.

In the ACU and Deadlock case, the sources consulted do not provide hashes, IPs, or C2 domains, but they do include references to victimology and timing. The first-observed date reported by ransomware.live was July 10, 2026, and the associated sector was transportation and logistics. GalaxyWarden and Pulse descriptions point to a data exfiltration pattern before encryption, consistent with double extortion.

TTPs observed in July campaigns

In the Uruguayan sites affected by the automated July campaign, the pattern described was a bot scanning thousands of sites for a specific vulnerability. In the technical version shared on YouTube, the use of outdated Joomla extensions is suggested, although that should not be taken as independent confirmation. Even so, the TTP logic is clear, mass reconnaissance, exploitation of public-facing surface, and availability disruption.

In the ransomware and extortion cases, the repeated tactic was pressure through publication of data or the threat of publishing it. BHU shows the classic variant with theft, ransom, and leakage after nonpayment. Section9 appears closer to the leak site ecosystem with a public threat. ACU, according to the intelligence sources, would have followed a double-extortion logic.

Material limitations

This report was built exclusively from the material provided for Uruguay, without internet access or additional external validation. The reporting window for the indicators is July 2026, with 72 dated events within the period and 2 without a confirmed date, which were excluded from the counts. Events from earlier months were used only as qualitative context when they were clearly identified as such, for example the BHU attack that occurred in October 2025. Aggregated telemetry was not added to the indicators, because material on attempts, scans or blocks does not constitute incidents.

When an indicator appears as 0, that means it did not appear in the material analyzed for the month, not that it did not happen in Uruguay or the region. This distinction is especially relevant for CVEs and for certain fraud or disruption categories. In this case, critical CVEs were mentioned, but the principle remains valid for any reading of absence. The absence of evidence in the corpus does not mean the absence of a real-world event.

Items without a confirmed date were also left out of the counts, even if they may provide context. In addition, the corpus includes sources of varying quality, from CERTuy, AGESIC, BCU and other official bodies to media coverage and ransomware intelligence platforms. Sponsored sources, commercial statements, consumer social networks and publications not included in the authorized list were excluded as evidence. When a claim depended on third-party monitoring or secondary coverage, that attribution was preserved and was not treated as official confirmation unless the material allowed it.