Mining, Metals and Natural Resources, July 2026

Threats and active campaigns

Ransomware and extortion, exfiltration without confirmed encryption

July produced one confirmed case of exfiltration with extortion at Ecopetrol, along with several signs of ransomware pressure, but the material does not always make it possible to determine whether assets were encrypted. In the correct taxonomy, the main case belongs under data exfiltration without confirmed encryption. Reuters, Yahoo Finance, and the company’s own documentation describe unauthorized access, data downloading, and a blocked ransomware attempt. That means the incident’s value lies in the stolen information and the follow-on pressure, not in systems going offline.

The same month also saw reports of BitLocker ransomware in Colombia and Mexico. Here, encryption was mentioned, but the strongest confirmation in the material is limited to the threat pattern and the tactic of printing ransom notes on corporate printers. Because the main source of technical detail is uncertain, these cases should be treated as tactical warnings, not fully audited incidents. Even so, the takeaway for the vertical is useful: BitLocker, exposed RDP, misconfigured SQL, and abuse of administrative tools remain a high-risk combination in Latin American enterprise environments.

The Gentlemen’s claim in the Ecopetrol case fits more closely with extortion and public pressure than with verified-encryption ransomware. The group said it had up to a terabyte of information and reportedly issued an ultimatum. As far as the available material goes, the firm evidence is the data leak and the associated threat, not system unavailability caused by encryption. That is why the report does not group everything under "ransomware," because doing so would erase differences that matter to a CISO.

Fraud and phishing

The month’s material includes four documented fraud or phishing cases, but the provided set does not show a broader sector narrative that would support treating them as a single campaign targeting mining, metallurgy, or natural resources. Even so, the data is useful because these tactics are often the first step toward more complex incidents. In organizations with distributed operations and heavy reliance on vendors, credential fraud, executive impersonation, and phishing aimed at finance or procurement staff remain plausible entry points.

The preventive reading is straightforward. When pressure centers on employee information, payroll, banking data, or credentials, the line between leakage, social engineering, and fraud becomes blurry. If the organization also operates multiple subsidiaries, as in the Ecopetrol case, the risk of cross-company impersonation within the group rises. In that environment, phishing-resistant authentication and out-of-band verification are not a luxury, they are a minimum barrier.

APT, industrial espionage and hacktivism

The material did not provide robust attribution to a state-linked APT or a clearly tied hacktivist campaign in the vertical. There are indications of interest in sensitive business, employee, and operational information, especially in the Ecopetrol case. The Gentlemen, according to the coverage, may have offered or hinted at access to internal files from several companies in the group. But that is not enough to classify the case as state industrial espionage or as APT in the strict sense.

What the month does show is that industrial espionage does not require a sophisticated campaign to cause harm. Exfiltration of drilling data, payroll records, medical data, or credentials, if any of what was circulated proves authentic, would have a direct impact on competition, litigation, labor relations, and vendor negotiations. For that reason, the response should not stop at the technical containment of the incident. It should also consider what information, even if it was not widely published, may have ended up in the hands of third parties.

Critical vulnerabilities

The material did record critical CVEs that were actively exploited, so the absence note does not apply here. The practical takeaway for this sector is that exposed collaboration surfaces, business applications, and edge appliances remain a recurring entry point. In environments with subsidiaries, contractors, and remote access, a product that lands in KEV quickly becomes a business issue, not just a patching issue.

Beyond the four CVEs listed above, several reports said CISA added other actively exploited vulnerabilities over the course of the month, including components from Fortinet, Microsoft SharePoint, WordPress Core, Langflow, DD-WRT and SonicWall SMA 1000. The point is not the brand count, but the pattern: attackers exploit patching windows in widely deployed technologies with broad reach. For a natural resources company, that means reviewing not only what runs in the plant, but also what supports identity, communications and access.

Regulation and compliance

July showed no broad regulatory movement in the vertical, and the documented regulatory movement indicator remains at zero. That did not make it a light month for the companies affected. In Ecopetrol, the filing of Form 6-K with the SEC opened a disclosure channel for investors in the United States, while coordination with Fiscalía, MinTIC, ColCERT, the Policía Nacional, and other Colombian authorities also placed the case in the criminal and public administration sphere.

The sequence helps explain how major incidents are handled in the region. Internal controls and technical containment come first. Then comes forensic preservation, reporting, and cooperation with authorities. After that, market disclosure enters the picture, and for companies with international exposure, so do materiality and consistency in the facts being disclosed. The month’s experience shows that this transition can no longer be improvised: if information spreads before the company has organized its own account, reputational costs rise.

It is also worth watching what did not appear. There was no documented wave of specific regulation for mining, metallurgy, or natural resources in Latin America in the source material. Even so, the lack of that front does not reduce the importance of corporate disclosure, interagency coordination, or response procedures for extortion and data leaks. For companies with listed securities or subsidiaries in multiple countries, that triangle of operations, forensics, and compliance is part of the incident, not a side task.

Countries and most affected subsegments

Colombia

Colombia was the center of gravity in July. Ecopetrol drew most of the attention and pulled its corporate group, subsidiaries, and supplier and customer ecosystem into a discussion about exfiltration, extortion, credentials, and compliance. Reuters, Infobae, El Colombiano, El Universal, El País, Caracol Radio and DiarioBitcoin converged on the same point: there was a serious incident, with data downloaded, and no public evidence of critical operational disruption at the time of reporting.

The material also shows that Colombia faces broader cyber pressure. Infobae cited more than 3,000 weekly cyberattacks against Colombian companies, although that figure comes from telemetry and not incident reporting, so it serves only as context. Added to that are references to ransomware incidents in the country and the presence of a significant mining base in other events during the period. The combination points to an environment where risk is not limited to the energy or extractive sectors, but spreads across the full value chain.

Mexico

Mexico stands out as another relevant point because of the escalation in cyberattacks and its role in the regional ransomware context. Infobae’s figure showing a 38% increase in cyberattacks, along with references to StrikeShark and SharkLoader, suggests broad pressure on Mexican companies. While the material does not show a mining or natural resources incident comparable to Ecopetrol’s, it does flag exposure in a large market with multiple sectors and heavy use of shared corporate infrastructure.

From an industry perspective, that matters because extractive and metals companies in Mexico often rely on extensive supply chains and mixed technology dependencies. If initial access comes through leaked credentials, exposed RDP, or abuse of business applications, the gap between a generic attack and an industrial incident gets much smaller.

Chile

Chile was more of a context story than an incident story. La República reported new prospects in the north of the country and Antofagasta’s exploration pipeline, while Mining Weekly noted plans for environmental approval to expand exploration in Encierro and Volcanes. None of that is a cybersecurity fact, but it does indicate business activity that widens the exposure surface. More exploration, more permits, and more partners also mean more identities, more documents, and more digital exchange points.

The absence of a verifiable Chilean incident in the material should not be read as absence of risk. In a subsegment heavy in geodata, engineering, and community relations, protecting sensitive information matters just as much as protecting industrial systems.

Peru

Peru appeared on the investment side of mining. The pipeline of 66 projects worth US$64.075 billion indicates a substantial amount of activity that, by itself, multiplies exposure to third parties, studies, permits, and collaboration platforms. This is not an incident, but it does help explain why attackers see value in this vertical: where there are more projects, more data moves around, and there are more opportunities for impersonation, intrusion, and intellectual property theft.

Energy and oil subsegment

Although the report’s focus includes mining, metals, and natural resources in a broader sense, July was dominated by oil and related services in the Ecopetrol case. That matters because risk is not confined to mines or smelters. Energy and extraction companies share with mining the intensive use of subsidiaries, contractors, logistics, financial systems, and document platforms. The case shows how an incident at a holding company with multiple subsidiaries can affect operations, legal, compliance, and communications at the same time.

Exploration and project pipeline

The Chile and Peru findings suggest that the exploration subsegment continues to grow, and with it the size of the digital attack surface. In exploration, the value of a file or database is not only in day-to-day operations, but also in future competitive advantage. That is why industrial espionage and extortion can have lasting impact even without visible disruption.

Trends and signals to watch

There is no historical comparative baseline, because this is the first archived period with this indicator format for Latin America. Even so, the month offers clear signals to monitor in August and in the months ahead.

The first is the consolidation of exfiltration with extortion as the dominant form of harm in the vertical, at least in the documented cases. Ecopetrol showed that data loss and public pressure can be more visible than encryption. The second is the persistence of initial access gained through third parties, credentials and exposed environments, something that appeared both in the Colombian investigation narrative and in attributed descriptions of ransomware in the region.

The third signal is the growing weight of compliance. When an incident reaches subsidiaries, user accounts, employee data and cloud environments, the debate stops being purely technical. In companies with stock market exposure or international contractual obligations, the line between cybersecurity, investor relations and regulatory reporting becomes blurred. July made that especially clear.

The fourth signal is tactical. The month left traces of ransomware that tries to adapt to the local corporate environment with printers, BitLocker, exposed RDP and SQL abuse. No exotic tool is needed to cause damage if the network has weak credentials or services published without control. The fifth signal is structural, actively exploited vulnerabilities continue to affect widely used technologies, from collaboration applications to edge appliances and business suites.

Security team recommendations

First, prioritize review of the third-party attack surface and privileged accounts. The Ecopetrol case, according to the investigation cited by Caracol Radio, points to initial access through a third party with administrator privileges. That means vendors, remote access, shared credentials, inherited privileges, and service accounts need to be audited. In a group with subsidiaries, the inventory of who can access what cannot be left scattered across spreadsheets or informal approvals.

Second, strengthen cloud storage protection and the classification of sensitive information. The month showed unauthorized data downloads in environments at roughly 15 subsidiaries. If the organization does not know where critical information lives, it cannot accurately measure what was lost or what legal exposure exists. Labeling, segregation, clear retention rules, and controls on copies and external sharing are needed.

Third, harden the remote access path. Exposed RDP, exposed or misconfigured SQL, and abuse of administrative tools appear as recurring patterns in the region. Phishing-resistant multifactor authentication, geographic and time-based restrictions, removal of legacy access, and monitoring for anomalous activity should be treated as baseline controls, not optional improvements.

Fourth, prepare a specific response for extortion and leak scenarios. The Ecopetrol case showed that an incident does not end when a ransomware attempt is blocked. The damage can shift to public circulation of files, negotiations with attackers, intervention by authorities, and handling internal claims. It is advisable to have communication scripts, forensic preservation workflows, and criteria for deciding what is reported, when, and to whom.

Fifth, review the security of printing and peripheral devices. The tactic of printing ransom notes is not central because of the paper, but because of the message, the attacker wants to make an impact outside the SOC and the admin console. Printers should be inventoried, segmented, and authenticated, with centralized logs. If they can receive jobs from compromised workstations without control, they can also amplify attacker pressure.

Sixth, speed up patching for technologies that appear in KEV. July included several references to Adobe ColdFusion, Fortinet, Microsoft SharePoint, SonicWall SMA 1000, and Oracle E-Business Suite. A slow remediation schedule, especially in internet-facing systems, leaves a window attackers already know how to exploit. In natural resources, where there is dependence on portals, integrations, and contractors, patching delays often multiply risk.

Seventh, practice exfiltration scenarios without encryption. Many playbooks are still built around full outage. July suggests a different scenario, operations continue, but sensitive data leaves the environment. That requires detection, containment, scope analysis, and legal coordination capabilities that are very different from a simple restore.

Material limitations

This report was built exclusively from the material provided for July 2026 and within the thematic scope of mining, metallurgy, and natural resources in Latin America. No internet access or sources outside the authorized list were used. Facts from prior months were left out of the reporting period and are used only as context when the source material allows it. There is also one undated fact, which is not included in any count or indicator; if mentioned, it should be understood as qualitative context, not as monthly volume.

The declared time window for the indicators is 57 dated facts in July 2026, with 1 undated fact excluded. That base should be read as a snapshot of the month, not as aggregated sector telemetry. Blocked attempts, scans, or detections were not counted as incidents. When vendor telemetry or weekly averages were cited, they were used only as context and not as evidence of a successful intrusion.

In particular, an indicator at zero means it did not appear in the material analyzed this month, not that it did not occur in the region. This is especially true for CVEs and regulatory moves. In this period, critical CVEs did appear in the material, so they were reported. If in another month a CVE indicator were zero, the correct reading would be no record in the corpus, not no vulnerabilities exploited in Latin America.

The material excluded consumer social media and sponsored posts, and sources outside the authorized list were not used as evidence. Any claim attributed by a source marked as uncertain was also treated cautiously, especially in Mallory.ai cases. When a source did not specify whether encryption was involved, or when the technical attribution was not confirmed by primary material, the report stated that explicitly to avoid overstating the event or mixing different taxonomies.

Graphic appendix

The month’s events show a concentrated sequence between July 17 and July 31, with Ecopetrol at the center of the densest activity. The timeline below summarizes that concentration and helps show how the case moved from unauthorized access and the blocking of an attempted ransomware attack to extortion, data disclosure, and regulatory and criminal response.