Logistics, Ports, Airports and Transport, Sep 2026

Active threats and campaigns

The month’s active threat picture clearly split between ransomware and extortion, fraud or phishing, and advanced espionage campaigns. The material does not point to a single dominant wave, but to several fronts affecting logistics, ports, and transportation in different ways.

Ransomware and extortion

Of the 9 cases where ransomware or extortion was the primary focus, only one had confirmed asset encryption, one involved exfiltration without encryption, two were mentioned only on leak sites, and five could not be conclusively classified from the available material. That breakdown matters because it separates operational damage from reputational pressure or negotiation. Not everything that appears on a leak site amounts to a verified, high-impact intrusion.

The case of the logistics company with operations in Colombia and Peru, reported by SIMCOD, is the clearest example of confirmed encryption with operational impact. The material says its billing and shipment tracking systems were encrypted for nearly four days, and that the company had to operate with spreadsheets and phone calls. A source described as uncertain also said initial access may have come through a phishing email sent to an administrative employee, and that there was no MFA or segmentation between operational and billing systems.

That episode is especially sensitive for the sector because it combines three common weaknesses, email access, poor segmentation, and disruption of critical back-office processes. A major multinational is not required for the damage to be significant. In mid-sized logistics firms, four days without billing and tracking can affect service, cash flow, customer support, and partner trust.

There were also references to public-sector entities and companies with a presence in Brazil, including mentions of the Caxias government and Receita Federal on leak sites or in claims by groups such as Emperador. In both cases, the material does not allow the intrusion or exfiltration to be fully confirmed, so they should be read as extortion pressure in an incomplete verification stage. The correct taxonomy here is explicit, mention or claim, not a closed fact.

Fraud and phishing

The month recorded 2 documented fraud or phishing cases, up from 1 in the previous month. The figure is not large, but it matches how incidents usually begin in transportation and logistics, initial access through email, portal impersonation, or credential capture. The SIMCOD case is again the most illustrative, because the source attributed the initial access to a phishing email sent to an administrative employee.

That pattern has direct operational consequences. In transportation and logistics companies, administrative users often have access to billing, suppliers, service orders, and operational support. If phishing reaches an account with broad permissions and there is no MFA or segmentation, the attacker does not need a sophisticated exploit to stop processes.

The practical reading is that fraud and phishing remain the most plausible entry point for incidents that later present as ransomware or disruption. September’s data does not suggest a sharp increase, but it does confirm that the human vector remains the cheapest path to high-value assets in the sector.

APT and hacktivism

The FamousSparrow campaign, and the discussion around Salt Typhoon, were the month’s main advanced-activity signal. In this case, the issue was not disruption but espionage. ESET, The Register, The Hacker News, and other coverage described a modular backdoor with persistence, exfiltration, and evasion capabilities. The Record said, as an assessment attributed to ESET, that the campaign was likely intended to help China monitor the reactions of Latin American governments.

The mention of a Panamanian entity tied to a port dispute again links this activity to the transportation and ports sector. The material does not show operational impact on terminals, airports, or logistics operators, but it does show interest in the institutional infrastructure surrounding foreign trade. That requires separating the actor’s apparent objective from the observable damage, which do not always match.

In priority terms, this category should not be confused with ransomware. Its main risk is sustained exposure, information gathering, and preparation for future operations. For security teams at ports, airports, and logistics companies, that means monitoring endpoints, email, and lateral movement, not just perimeter defenses.

Critical vulnerabilities

No critical CVEs were recorded in the material analyzed for September 2026. That does not mean critical vulnerabilities were absent from the region, only that this sample did not identify any as such. The month focused on product alerts and update recommendations rather than a closed list of CVEs explicitly tied to the sector.

The table below summarizes the technical advisories that did appear in official sources and may have cross-sector impact on logistics organizations, ports, airports, and transportation.

The value of these notices for the sector is indirect but real. A booking portal, a secure mail system, an authentication environment, or an e-commerce front end can become the first step in an access chain. Although the material does not link each alert to a transportation or logistics incident, it does point to the kind of attack surface threat actors can exploit.

Regulation and compliance

There were no documented regulatory moves for the vertical in September 2026, compared with 10 the previous month. The drop does not mean a softer regulatory environment, but rather a lack of such developments in the material analyzed. What did appear was a more operational compliance and governance response, especially in Brazil and in the Águia Branca case.

Brazil again served as a regional gauge of regulatory maturity and technical response. CTIR Gov issued alerts and recommendations on Secure Email Gateway, Magento, Chromium V8, Cisco ISE and active campaigns against government web servers. Brazil's Ministry of Defense also promoted the Guardião Cibernético 8.0 exercise with around 1,300 participants and 300 organizations, including the transport sector among the strategic infrastructures simulated.

That exercise matters because it shifts the compliance discussion from rules to drills. The transport industry not only has to respond to incidents, it also has to practice continuity, communications and coordination with authorities. In practice, that applies just as much to passenger companies as it does to port operators, terminals and cargo logistics providers.

The Águia Branca case also touched the regulatory side in a concrete way. The company reported the incident to the ANPD and notified potentially affected users individually. That does not solve the problem, but it does show a course of action that other transport firms should treat as standard when exposure affects passengers' or customers' personal data.

Countries and most affected subsegments

The geographic spread in September was uneven. Brazil accounted for much of the compliance activity, technical alerts and some extortion incidents, while Mexico, Panama, Colombia and Peru appeared across different risk and exposure fronts. The readout needs to be done by country where the facts are documented and by subsegment when the material allows it.

Brazil

Brazil was the country with the highest density of signals in September, though not necessarily because of the operational impact volume in the vertical. The Águia Branca case set a clear reference point for passenger transport. It was joined by CTIR Gov alerts on vulnerabilities and active campaigns, plus the events tied to Emperador and the government of Caxias in Minas Gerais, although the latter were not conclusively confirmed in the material.

The relevance for logistics, ports and transport lies in the combination of public exposure and response maturity. Brazil is not only dealing with incidents, it is also institutionalizing exercises and advisories. For companies with local or regional operations, that means notification thresholds and response expectations are becoming more demanding.

Mexico

Mexico appeared as a reference on two different levels. On one side, the SCILabs report cited by La Jornada and El Economista said around 52 Mexican companies and entities were hit by ransomware in the first half of 2026, with a significant regional concentration. On the other, the country continued to appear in the broader map of information kidnapping activity in Latin America.

Although those figures do not reflect September volume in this vertical, they do help frame the ransomware pressure on companies with cross-border supply chains, transport operators and support services. The most sensitive subsegment remains corporate, not only because of size but because of exposure to billing, support and document logistics.

Panama

Panama drew attention because of a mention of an entity involved in a Canal port dispute within the campaign attributed to FamousSparrow. The material does not show evidence of an operational incident at a Panamanian port, but it does show strategic interest in a highly sensitive logistical space with geopolitical weight.

For the vertical, Panama matters as a transit hub and as an environment where authorities, concessionaires, shipping lines and service operators converge. That raises the value of intelligence, corporate email and digital identity. An advanced actor does not need to disrupt a port to gain leverage if it can map its ecosystem.

Colombia and Peru

Colombia and Peru appear together because of the medium-sized logistics company that suffered ransomware and was left without billing and tracking systems for four days. It is the clearest example of operational damage in the sample. The disruption was not abstract: the company fell back on spreadsheets and phone calls to keep operations running.

That kind of interruption has direct consequences for SLAs, deliveries, collections and customer reputation. It also forces companies to think about internal segmentation, business continuity and offline capabilities. For transport and logistics operators in both countries, the lesson is that resilience is not tested when everything works, but when the main system goes down.

Passenger transport, heavy logistics and maritime

Within the vertical, passenger transport was hit by the Águia Branca case, with a focus on reservations and customer data. Heavy logistics was represented by Transportes Montejo and by the logistics company in Colombia and Peru that suffered encryption. Maritime was the subsegment with the greatest strategic weight, driven by the tankers under investigation and the attention given to port security.

That distribution shows a fragmented vertical. There is no single pattern. There are passenger operators vulnerable in their front ends, logistics companies exposed to ransomware because of weak segmentation, and maritime environments where IT and OT mix, so an intrusion can have broader effects. The sector reading, therefore, has to be specific, not generic.

Trends and signals to watch

Compared with the previous month, verified incidents, unclassified cases, and ransomware or extortion incidents all declined, while fraud and phishing edged up slightly. Regulatory activity that appeared in the prior sample also disappeared this month. The underlying trend is not easing, but a reshuffling, less aggregate noise and a tighter focus on specific cases with operational impact or advanced monitoring.

In the previous month, incidents had been the dominant threat category. In September, unclassified cases took that place, pointing to a more dispersed and less uniform mix. That matters because it suggests public coverage is not capturing a single wave, but multiple episodes at different stages of intelligence maturity. For a CISO, that complicates prioritization and forces attention to impact type, not raw volume.

The first signal to watch is the persistence of ransomware with real impact on midsize logistics operations. The case in Colombia and Peru showed that encrypting billing and tracking systems is still enough to halt processes for days. The second is the continued appearance of mentions on leak sites without strong confirmation, which may conceal extortion in preparation or attempts at reputational pressure. The third is the advance of espionage campaigns aimed at Latin America, especially when they affect ports or entities linked to foreign trade.

The most useful comparison point is the maritime sector. The August and September events, although they do not make up the volume from the previous month in this report, show a sequence of investigation, boarding, and technical analysis on tanker ships. That should not be read as a confirmed campaign against the region, but it does signal sustained attention on the maritime surface from both threat actors and authorities.

Security team recommendations

This month’s priorities are more operational than theoretical. The first recommendation for transportation and logistics teams is to harden the perimeter around bookings, quoting, billing, and tracking. The Águia Branca case shows that an incident in the commercial front end is enough to compromise customer data and force individual notifications. Those environments should have MFA, anomaly monitoring, and reviews of third-party integrations.

The second is to review segmentation and recovery at mid-sized companies. The case of the logistics company with operations in Colombia and Peru showed that when billing and tracking are encrypted, the organization falls back to manual operations. That is not a minor detail. Administrative and operational domains need to be separated, restoration should be tested, and offline procedures should be defined that do not depend on the availability of email or the main ERP system.

The third priority is to reduce the phishing attack surface. This month’s material again points to an initial email aimed at administrative staff. In logistics and transportation companies, that group often holds permissions useful to attackers. Awareness programs should focus on accounts with access to shipping documents, collections, payroll, reservations, and vendors, not on generic campaigns for the entire workforce.

The fourth is to strengthen monitoring of leak sites and early mentions, but without confusing them with confirmed intrusions. Transportes Montejo is a useful example of how to separate reputation from incident. A mature team must know how to distinguish a claim from a technical fact and respond differently to each one. The first requires intelligence and verification, the second containment and forensic analysis.

The fifth is to view the maritime and port front as an extension of the corporate network. Reports on tankers under investigation for malicious activity, along with the alert on port security in the Bahamas, are a reminder that logistics continuity depends on communications systems, access, and coordination among multiple actors. Teams operating ports, terminals, or fleets should review credentials, segmentation between IT and OT, emergency procedures, and coordination with local authorities.

The sixth recommendation is to align compliance, response, and drills. Brazil issued technical advisories, operational recommendations, and a national exercise this month that included transportation among strategic infrastructures. The lesson applies across the region: policies are not enough. Teams need to rehearse service shutdowns, external communications, regulator notifications, and a controlled return to operations.

Frequently Asked Questions

What did this month combine between real incidents and espionage campaigns?

September combined a passenger transportation data incident, ransomware that encrypted a logistics company, and espionage campaigns linked to Latin America and port-related interest. The common thread was not volume, but the range of impacts. To understand them better, it is worth reading the Relevant incidents and Active threats and campaigns sections together.

Which cases had proven operational impact, and which remained only pressure or mentions?

Proven operational impact appeared in the encryption of billing and tracking systems at a logistics company with operations in Colombia and Peru, and in the exposure of Águia Branca customers. By contrast, Transportes Montejo appeared only as a mention on a leak site, and several claims about Brazil went no further than unconfirmed attribution. The distinction is developed in Relevant incidents and Active threats and campaigns.

Which countries received the most attention in the material, and why?

Brazil stands out for technical advisories, institutional response, and a passenger transportation case. Mexico appears because of regional ransomware pressure. Panama comes up because of the mention of an entity involved in a port dispute, and Colombia and Peru because of the logistics case involving encryption. The country-by-country reading is developed in Countries and subsegments most affected and in Regulation and compliance.

What should a transportation or logistics operator review first?

First, access to the front end for reservations, sales, billing, and tracking. Next, segmentation between administrative and operational systems, and offline recovery plans. This month showed that a phishing email can open the door and that encrypting a billing environment is enough to stop operations for several days. The specific recommendations are in Recommendations for security teams.

Were there any critical CVEs directly tied to this vertical?

No critical CVEs appeared in the material analyzed for September 2026. There were alerts about Secure Email Gateway, Magento, Chromium V8, Cisco ISE, and a campaign against government web servers in Brazil. That does not mean critical vulnerabilities were absent from the region, only that none were recorded as such in this sample. The table is in Critical vulnerabilities.

Material limitations

This report was built exclusively from the material provided for September 2026 and from facts from earlier months used only as a comparative frame when the text allowed it. The indicator base is the one stated in the material itself, with 56 verified facts from the period and 59 facts dated September 2026 within the time window used for the indicators. Facts without a confirmed date were left out of the count.

A zero indicator, especially for critical CVEs, means none were recorded in the material analyzed for this month, not that no critical vulnerabilities were exploited in the region. The same applies to regulatory moves. Their absence in the table reflects a lack of documented facts in this sample, not the absence of regulatory activity in Latin America.

Telemetry also has to be separated from incidents. Figures for attempts or blocks, such as those for the Port of Los Angeles, are automated volumes of malicious activity filtered by defense systems, not confirmed intrusions. For that reason, they are not added to the monthly total and are not used as evidence of regional impact.

Finally, sources whose content did not allow the date to be confirmed were left out of the indicators, as were materials that offered only unverified claims, promotional content, or coverage without enough technical confirmation to close an incident. That cut reduces noise, but it can also leave out early signals that still do not meet the verification threshold required for this report.