Uruguay Cybersecurity Update: October 2026

Threats and active campaigns in Uruguay

The month’s most visible threat activity was fraud, followed by ransomware claims that could not be independently verified. At the same time, Interpol’s local campaign on deepfakes and AI-powered scams helped frame the kind of deception that drew the most attention in Uruguay’s public conversation.

Ransomware and extortion with undetermined classification

There were 3 cases with ransomware or extortion as the primary focus, but the material did not allow a precise determination of whether there was encryption, exfiltration, or only a mention on a leak site. The clearest example was Punta Shopping, logged by monitoring sites as a victim attributed to Emperador, with a supposed 1.6 GB file and an announced publication date.

The same caution applies to the Asociación de Escribanos del Uruguay, linked in several trackers to NightSpire or Nightspire. The sources cite claims, victim names, and estimates of compromised accounts, but they do not provide independent confirmation of intrusion or actual exfiltration. From an editorial standpoint, the month produced victimization claims, not a verified breach.

Fraud and phishing

Fraud maintained a steady, overtly social presence. Operación Pinterest described a social media scam based on fake furniture sales, while other coverage detailed impersonations of police officers or officials from the Ministry of the Interior to push victims into loans, transfers, cash withdrawals, and purchases of high-value goods.

Interpol and the Ministry of the Interior’s campaign on deepfakes fits that pattern. In October, Uruguay joined the international warning about synthetic content used for scams, impersonation, and extortion. The signal points not only to technology-related crime, but also to a combination of social engineering, audiovisual manipulation, and vulnerable financial channels.

Signs of ransomware on leak sites

Punta Shopping appears in EMPERADOR ransomware records with a claim involving personal and customer data, but the available evidence does not confirm the attack or the authenticity of the file. The same applies to the traces associated with NightSpire involving the Asociación de Escribanos del Uruguay. These are signals that merit follow-up, not established facts.

The difference between a leak site and a confirmed breach matters for both defense and public communication. This month, the material supports claims by actors and monitoring platforms, but not independent validation of encryption, exfiltration, or operational impact on the Uruguayan organizations mentioned.

Critical vulnerabilities affecting Uruguay

The month’s two critical CVEs affected widely deployed software and account for most of the preventive response in Uruguay. The impact was mainly operational and defensive, centered on patching, temporary isolation, and exposure verification.

The technical scope was broad. The advisories cited mention Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, as well as applications such as WordPress, Drupal, Joomla and Moodle. The patched versions were PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Regulation and compliance in Uruguay

October brought only one documented regulatory move in the monthly count, but its practical impact was broad. The Central Bank tightened authentication and monitoring requirements for electronic transactions, while other regulatory and governance measures continued to shape the compliance perimeter.

BCU Circular 2,497 took effect on October 1 and expanded strong authentication for access to digital channels, transfers or payments, off-site card purchases, loan applications, and changes to sensitive data. It also required alerts for attempts to modify passwords, PINs, email addresses, phone numbers, and other operational or security settings.

Implementation did not remain theoretical. Material cited by the press and legal analysis describes controls over unknown devices, geolocation, suspicious patterns, and unusual transactions, along with limited exceptions for specific cases. The regulatory intent is clear, reduce channel fraud and improve traceability and early detection.

At the same time, the country continued to move forward on governance and compliance for data and artificial intelligence. The BCU approved an AI Governance Framework with a mandatory inventory of systems, traceability, and security controls, while URCDP reported progress in international cooperation on data governance. These are not cyber incident reports, but they do form part of the month’s regulatory environment.

Most affected sectors in Uruguay

The month affected at least 7 sectors, and the impact was uneven. The public sector drew the most attention because of the PHP alert and preventive takedowns, while finance, retail, and digital services surfaced through incidents, fraud, and compliance pressure.

The public sector was the most exposed to defensive response. Ministry portals, the Electoral Court, state services, and public procurement systems were temporarily taken offline or removed as a precaution. There was no public confirmation of exploitation, but there was real, simultaneous operational disruption across multiple services.

Finance faced two fronts. On one side, the BCU tightened authentication and controls, affecting banks, managers, exchange houses, transfer companies, and lending platforms. On the other, Nobilis Corredor de Bolsa reported an external access attempt with no declared operational damage.

Retail and ecommerce were marked by the Punta Shopping signal, while telecommunications and critical infrastructure appeared through Antel outages, although those outages were not cyber-related. In digital services, reliance on PHP showed how a global flaw can escalate into local unavailability for agencies and platforms built on the same technology base.

Trends and signals to watch in Uruguay

Compared with September, nearly every verified activity indicator declined. Incidents fell from 67 to 41, unclassified incidents dropped from 11 to 2, ransomware or extortion went from 14 to 3, fraud or phishing from 9 to 5, and regulatory moves from 9 to 1. The month’s signal was smaller in volume, but more concentrated and clearer in its main focus.

The most important trend is the shift from confusion to classification. In September, the material showed a more scattered agenda, with more unclassified incidents. In October, by contrast, the vulnerability surface was clearly organized around PHP and the response from public agencies. That improves defensive reading, although it does not by itself reduce technical exposure.

The AI-assisted fraud vector also deserves close monitoring. The Interpol campaign, warnings from the Ministry of the Interior, and scams involving impersonation of authorities indicate that the problem is no longer limited to classic phishing. The risk combines voice, text, image, and time pressure on victims who end up authorizing transfers or handing over assets.

For ransomware, the signal to watch is not the number of posts, but the quality of the evidence. October included several claims from EMPERADOR and NightSpire/Nightspire, but without enough independent confirmation. If verifiable data, encryption, or exfiltration emerge in November, it will be necessary to distinguish immediately between an operational incident and a mere claim of victimization.

Recommendations for security teams in Uruguay

The immediate priority for Uruguayan teams is still to inventory PHP exposure, verify versions, and close patch gaps in internet-facing services. If fixes cannot be made right away, applications should be isolated, access surface reduced, and any portal, plugin, or legacy service still running vulnerable branches reviewed.

In the public sector and among vendors that support the state, the operational focus should be tighter change control and stronger continuity plans. October showed that preventive disconnection may be necessary, but it must be paired with internal communication, a maintenance window, critical portal prioritization, and restoration testing.

In financial services, the focus should be on stronger authentication, user notifications, and detection of anomalous activity. The BCU's new regulation is already pushing in that direction. The remaining gap is turning it into effective controls over unknown devices, geolocation, attempts to change sensitive data, and social engineering fraud patterns.

To address fraud and impersonation, specific training is needed, not just broad awareness campaigns. This month's cases show attackers exploiting urgency, simulated authority, and social networks. Customer service, risk, and operations teams should have verification scripts, dual approval for sensitive transfers, and alerts for deepfakes or manipulated calls.

Frequently asked questions

What was the link between the PHP vulnerability and the shutdowns of government sites in Uruguay?

The link was direct in the preventive response, not in a confirmed intrusion. CERTuy warned about two critical CVEs in PHP, and several agencies took portals or systems offline while applying patches. Official and media coverage agree that there was no public confirmation of exploitation in Uruguay.

What is the difference between the October ransomware claims and a confirmed ransomware case?

In October, there were 3 cases with ransomware or extortion as the main focus, but the material did not make it possible to determine whether there was encryption, exfiltration, or only a mention on leak sites. Punta Shopping and the Asociación de Escribanos appear in claims by actors or trackers, but without independent validation of compromise.

How do the new BCU rules and the month's fraud cases overlap?

They overlap in the same operational problem, payment authorization and sensitive changes. The BCU required stronger authentication, alerts, and device controls, while the month's scams used pressure, impersonation, and transfers to take money from victims. The regulation is aimed precisely at tightening that part of the process.

Which sectors showed the most exposure in October if the incidents and vulnerabilities are read together?

The public sector was the most visible because of temporary shutdowns of portals and systems, followed by the financial sector, which combined new regulation with an incident at a brokerage firm. Retail, telecom, and digital services also showed signs of exposure, but at lower intensity and with different mixes of technical failures, fraud, and ransomware claims.

What should a Uruguayan SOC team be watching after this month?

It should watch PHP exposure, version changes, update processes, and any attempt to access public portals or exposed web services. It is also worth tightening detections for social engineering fraud, reviewing alerts for changes to sensitive data, and treating leak site posts with caution, because October showed a lot of claims and little confirmation.

Technical appendix: indicators of compromise and TTPs

No public, verifiable IoCs, such as hashes, domains, IPs or malicious URLs, are firmly tied to a specific campaign in the October material. Vendors did publish TTPs. Unit 42 and Trellix link the activity to exploitation of exposed applications, command execution, web shells, payload staging and persistence in processes related to PHP.

Material limitations

This report was prepared exclusively from the dated facts from October 2026 included in the provided material. The stated time window for the indicators is 43 dated facts from October 2026, and the calculation base for the indicators is 41 verified facts from the period. Vendor telemetry figures were excluded from the volume because they reflect potential exposure or technical detection, not incidents with confirmed impact.

A 0 indicator, especially for CVEs or specific classifications, means it was not recorded in the material analyzed this month, not that the phenomenon does not exist in Uruguay or in the region. In particular, the absence of a precise ransomware classification should not be read as a lack of activity, but as a limitation of the available evidence.

Undated facts were also left out of the quantitative analysis, and sources excluded by the guide were not used, such as consumer social networks or sponsored posts. When a news source repeated a claim from an actor or a tracker without independent validation, it was treated as attributed and not as confirmation of compromise.