Latin America Cybersecurity Outlook, August 2026

Active threats and campaigns

Criminal activity in the month showed fewer confirmed ransomware cases than in July, but it kept the same cross-border campaign pattern, public pressure through leak sites, and strain on critical sectors. On the fraud side, perceived intensity remained high and was increasingly driven by social engineering and deepfakes.

Ransomware and extortion

The Gentlemen was again the most visible actor in regional reporting, with activity in global campaigns and victims in Argentina and Brazil. Its expansion does not rely on encryption alone, because the group uses multi-extortion, public pressure, and a mix of intrusion through exposed perimeters, tool reuse, and cross-targeting.

The most useful August data point is that, of the 41 cases where ransomware or extortion was the primary focus, only 6 had confirmed asset encryption. In 4, there was exfiltration without encryption, in 5 the evidence was limited to a leak site mention, and in 26 the material did not allow a clear determination of the exact method. That breakdown suggests the extortion ecosystem is more fragmented than the generic label "ransomware" implies.

Among the most visible campaigns were those attributed to The Gentlemen, DragonForce, CoinbaseCartel, BLACKWATER and Kazu. DragonForce posted victims in Argentina and Brazil, CoinbaseCartel listed Flecha Bus, BLACKWATER appeared with AMCA, and The Gentlemen kept adding cases in Argentina, including Criba and the claim against Oldelval. The same country appearing across several different families does not point to a single flaw, but to a broad and uneven attack surface.

Fraud and phishing

Fraud and phishing remained the most routine threat and, at the same time, the one most adapted to product changes and regulation. Argentina showed a clear shift from card cloning to fake pages, impersonation, vishing and WhatsApp-based attacks, while Brazil strongly brought deepfakes and AI-powered identity cloning into focus.

The figure of 85 documented cases does not capture the full phenomenon. August reporting shows the opposite, a fraud landscape shifting toward cheaper ways to scale and methods that are harder for end users to identify. In several countries, facial verification, biometrics and authentication flows became part of the problem rather than the solution, because attackers learned to imitate or work around them.

Pressure on the financial system was also visible in references to digital payment fraud, investigations into biometric controls and complaints against banks and fintechs. The signal is not only that fraud is growing, but that it is becoming multichannel and combining emotional manipulation, automation, templates based on well-known brands and opportunistic use of official or semi-official channels.

APT and hacktivism

The only clearly attributable APT signal in the material was the exploitation of CVE-2026-73570 by groups linked to Russia, with campaigns against government agencies, universities and state institutions in Brazil and Argentina. That reference was not accompanied by a large volume of regional cases, but it carried high strategic value because of the target profile.

August did not show a large block of hacktivism with confirmed operational impact comparable to ransomware or fraud. The APT signal instead serves as a reminder that government, education and state infrastructure perimeters remain exposed to geopolitically motivated or espionage-driven campaigns, and that a critical vulnerability can open a regional window even if the rest of the month is dominated by another type of incident.

The low number of critical CVEs mentioned should not be read as reassurance. The material recorded only two, which means that in this sample the focus was on regulation and fraud rather than public exploitation of technical flaws. That does not mean there were no exploited vulnerabilities in the region.

Critical vulnerabilities

Few critical CVEs were recorded in the material reviewed for August, and that marks a shift from July. The right reading is not that the region had no technical exposure, but that this month’s corpus focused elsewhere, especially on regulatory enforcement and extortion and fraud campaigns.

The evidence of technical exploitation this month was limited, but relevant because of the type of environment exposed. In Zimbra, the targets are state and academic entities in the region. In The Gentlemen, the focus is on exposed perimeters such as VPNs and firewalls, rather than on a single platform. Both signals point to a hybrid attack surface, public vulnerability paired with poor operational exposure.

Regulation and compliance

Regulation was the dominant threat of the month because it stopped being a background factor and began shaping how the market responded. The regulatory bloc saw action on privacy, platforms, payments, biometrics, AI, child protection, transparency, and financial oversight across several countries in the region.

Brazil was the most intense case. ANPD fined ByteDance for improper handling of adolescent data and reinforced a large-scale enforcement strategy, with cases against major platforms, guidance on security incidents, transparency rules for minors, and regulatory debate over deepfakes and synthetic content. The message is clear: Brazil's authority is no longer acting only on isolated violations, but on business patterns and platform design.

In Argentina, the BCRA continued expanding rules for payment methods, transfers, installment debits, and oversight requirements. The new Cobro con Transferencia mechanism, the update to clearinghouse rules, and the discussion on incident reporting in fintech are consolidating a payments ecosystem that is increasingly traceable and more demanding. There is no single cybersecurity law, but there is a network of rules that effectively covers much of the field.

Mexico moved on two fronts. On one hand, Banxico opened public consultations on payment networks and clearinghouses, with a focus on efficiency, interoperability, and operational security. On the other, the debate over the Federal Cybersecurity Law remains unresolved, leaving the country with a fragmented architecture where compliance depends more on circulars, sector-specific rules, and prudential regulation than on a single framework.

Chile, for its part, continued debating the delay of the Personal Data Protection Law. The issue is not minor, because a possible postponement of the effective date would affect the credibility of the digital rights agenda and extend uncertainty for companies that are already preparing for the future agency and a stricter compliance regime. The debate is no longer about whether regulation will arrive, but when it will and how strict it will be in practice.

Paraguay and Colombia present two different problems. Paraguay already has a data protection law in force, but public debate still revolves around draft bills and the lack of more developed cybersecurity rules. Colombia, according to the month's analyses, still has no comprehensive cybersecurity law and relies on scattered rules, which fragments digital defense and complicates the assignment of responsibilities. That fragmentation was underscored in local coverage.

Countries most affected in Latin America

The month’s geographic spread was clearly tilted toward Brazil and Argentina, with Chile, Mexico, Colombia, Paraguay and Bolivia standing out as countries of regulatory relevance or isolated signals. Peru did not provide enough material for a standalone reading in this corpus, and the United States appears only as an incidental reference in some comparative analyses.

Argentina

Argentina showed the most visible mix of ransomware, fraud and secondary regulatory pressure. Oldelval dominated the critical infrastructure conversation, while Flecha Bus, AMCA and Criba kept the country present in extortion panels. At the same time, bank fraud continued shifting toward WhatsApp, phishing, vishing and deepfakes, with signs of greater judicial action against banks for security or response failures.

The sector-level picture in Argentina shows three sensitive areas: energy, transportation and financial services. Energy was exposed through Oldelval and the critical infrastructure discussion. Transportation came up with Flecha Bus and La Sevillanita. The financial system remained under pressure from scams, court-ordered refunds, digital fraud and new BCRA rules. The country did not have the highest number of total events, but it did have the widest range of fronts under strain.

Brazil

Brazil was the month’s epicenter by regulatory volume and by the density of privacy and fraud incidents. The ANPD issued decisions on TikTok, Discord, proceedings against major tech companies and guidelines for minors, AI and deepfakes. At the same time, Latam reported a security issue in Latam Pass, and Mobilemed emerged as a possible victim in digital health.

On the fraud front, Brazil showed a clear escalation in the use of generative AI for impersonation, cloning people and creating deepfakes in deceptive campaigns. This trend is not just technical, it is behavioral. End users are facing more convincing forgeries, with direct consequences for identity verification, onboarding and stronger authentication. The month left Brazil as the region’s main regulatory laboratory and the main gauge of synthetic fraud.

Chile

Chile was dominated by debate over the postponement of the Personal Data Protection Law and by the passage in general of the anti deepfake bill. The country’s agenda was shaped by two different timelines, one tied to the entry into force of already approved rules and another tied to delays in setting up the new data protection agency.

The clearest signal is that Chile has entered the political implementation phase of its data regime. The concern is not theoretical. If full enforcement is delayed, the business ecosystem gains some time, but the institutional closure required for the law to operate is also pushed back. The country therefore stands out as one of the Cono Sur’s most relevant regulatory focal points, although it had fewer operational incidents than Argentina or Brazil.

Mexico

Mexico combined financial reform, Banxico public consultations and a federal cybersecurity law that still has not been approved. The debate centered on payments, cards, clearing houses, incident reporting and prudential oversight of Sofomes and fintechs. The country still lacks a single framework, but sector-specific regulation is advancing with considerable intensity.

The Mexican problem is not a lack of activity, but fragmentation. The CNBV, Banxico, the DOF and other agencies are pushing pieces that affect payment and data security, but the legal architecture remains spread across multiple instruments. That forces companies to read risk horizontally. Financial compliance, privacy, authentication, continuity and incident reporting do not sit in separate silos.

Colombia

Colombia stood out less for specific incidents and more for its structural diagnosis. Local media reported that the country still lacks a comprehensive cybersecurity law and that its framework relies on scattered rules, a situation that limits defensive cohesion against growing threats. In a regional context marked by synthetic fraud and pressure on identity, that weakness is more visible than in previous months.

Paraguay

Paraguay showed a clear signal in data protection, with Law No. 7.593/2025 already part of public debate, but without a consolidated cybersecurity bill identified in the Senate based on the information retrieved. The country combines a more modern privacy base with a still fragmented discussion about institutional cybersecurity.

Bolivia

Bolivia showed an institutional agenda focused on 2FA, strengthening the CSIRT and digital protection. At the same time, signs emerged of a possible breach and of opaque political digital activity, such as the so-called mini bot farm linked to Fernando Cerimedo. August’s material suggests an ecosystem that is more active in building capacity than in producing confirmed incidents, although exposure is growing in public and financial services.

Trends and signals to watch

The comparison with the previous month shows relative improvement on some fronts and a worrying acceleration on others. Unclassified incidents fell, ransomware or extortion cases as the primary focus dropped sharply, and documented fraud or phishing also declined. But the month shifted much more toward regulation, and that change is not cosmetic.

Compared with July, the drop in ransomware from 126 to 41 cases should be read with caution. It does not mean the actor lost capability, but rather that August’s corpus included fewer events of that type and more regulatory material, along with campaigns where classification could not be determined. The key point is not only volume, but the persistence of groups such as The Gentlemen, DragonForce, Qilin, BLACKWATER and Kazu across different countries in the region.

The regulatory jump from 261 to 410 events is the month’s most important change. Brazil drove most of it, but Argentina, Mexico, Chile and Paraguay also contributed. The underlying signal is that states are closing the gap between observed risk and applicable rules, especially in payments, children’s data, digital platforms and incident reporting.

The decline in critical CVEs mentioned, from 22 to 2, is also significant, although it should not be overstated. In August, the available material focused on public policy, enforcement and fraud more than technical vulnerability exploitation. That does not mean the technical attack surface shrank, only that it was less visible in the corpus analyzed.

The signal to watch for September is the convergence between regulation and fraud. When authorities tighten controls, authentication, traceability and reporting, more sophisticated evasion attempts often follow, especially in banking, fintech and platforms with large user bases. The month makes it clear that the next pressure will come not only from malware, but from social engineering adapted to new requirements.

Security team recommendations

Security teams across the region should treat August as a priority signal, not a calendar footnote. The first step is to review which parts of the business are exposed to regulation that is already in force or still in transition, because several of the month’s cases ended in sanctions, formal inquiries, or new reporting obligations.

In financial firms, fintechs, and payment providers, the priority should be tighter authentication, stronger identity monitoring, and better incident traceability. This month’s reporting showed vishing, phishing, deepfakes, impersonation of authority figures, and manipulation of onboarding flows. That calls for a mix of technical controls, out-of-band verification, and faster rollback and reporting procedures.

In energy, transportation, health care, and shared services, the focus has to be on real segmentation of environments and readiness to respond to extortion. Oldelval and Mobilemed offer a similar lesson, even if the incidents were different. An intrusion into administrative systems may not stop operations, but it can still disrupt continuity, strain the relationship with regulators, and widen the attacker’s leverage.

It is also worth reviewing perimeter exposure and remote services. Activity attributed to The Gentlemen and other groups again points to abuse of VPNs, firewalls, and exposed access points. That requires rapid patching, well-implemented MFA, an inventory of external access, rotation of privileged credentials, and a serious exercise in detecting lateral movement.

For legal and compliance teams, the message is not to wait for a single law before acting. In Brazil, Argentina, Mexico, and Chile, there is already enough regulatory material to justify programs for privacy, incidents, retention, vendor governance, and risk assessment. Regulatory fragmentation is not an excuse. It is the normal condition of the Latin American market.

Finally, response playbooks should be ready for cases where the public evidence is incomplete. Several incidents this month surfaced on leak sites or as preliminary claims. That means a team may need to respond before confirming the full intrusion. In that scenario, the most useful steps are not guessing attribution, but cutting off access, preserving evidence, reviewing credentials, and closing the door on a second wave of extortion.

Frequently Asked Questions

Why was August dominated by regulation, not ransomware?

Because the monthly base concentrated 410 regulatory moves versus 41 ransomware cases or extortion as the primary focus, and there were also 85 fraud or phishing incidents. Regulation absorbed more than half of the signal because Brazil, Mexico, Argentina and Chile moved rules, sanctions and consultations that directly affect security and data.

Which countries showed the strongest combined pressure from incidents and compliance?

Brazil and Argentina. Brazil combined an ANPD record fine against ByteDance, expanded oversight and signs of synthetic fraud. Argentina added Oldelval, Flecha Bus, AMCA, Criba and a strong front of financial scams. Chile stood out more for regulation, and Mexico for prudential changes and Banxico consultations.

How should the ransomware cases from the month be read?

With caution and by separating three layers, confirmed encryption, exfiltration without encryption, and a mention only on a leak site. In August, of the 41 cases with ransomware or extortion as the primary focus, only 6 had confirmed encryption, 4 were simple exfiltration, 5 stayed on leak sites and 26 could not be classified precisely.

What changed in digital fraud compared with the previous month?

The documented volume fell, but the tactics became more sophisticated. The material shows less card cloning and more phishing, fake websites, vishing, deepfakes and identity theft, especially in Argentina and Brazil. The combination with biometrics and facial validation raised the risk of bypassing controls.

What do the two critical vulnerabilities mentioned imply?

They show that technical exposure did not disappear, even though the month was dominated by regulation. CVE-2026-73570 affected Zimbra and was exploited against government and academic targets in Brazil and Argentina, while CVE-2026-50751 was cited as a likely vector in The Gentlemen campaign. The low number does not mean there is no risk.

Material limitations

This report was built exclusively from the material provided for August 2026 and the comparative frame from earlier months included in the file. There was no internet access, and no sources outside the authorized list were used. Facts without confirmed dates were left out of the indicators and used only when they helped provide context.

The stated time window for the period included 904 dated incidents in August 2026, 64 from earlier months as a comparative frame, 25 without confirmed dates excluded from the indicators, and 7 after the period, also excluded. The monthly indicators are reproduced exactly as provided and were not independently recalculated.

An indicator of 0, especially the critical CVEs indicator, means none were recorded in the material analyzed for this month, not that no vulnerabilities were exploited in the region. The same applies to any missing sector or country in a specific section. The absence of evidence in this corpus does not mean the phenomenon did not exist.

Aggregated telemetry, automated attempts or blocks, and promotional content were also excluded as trend evidence, along with press releases and advertorials when they were the only basis for the claim. Figures for fraud attempts, blocks, or scans were mentioned only when the material allowed them to be attributed to a vendor and made clear that they are not incidents with confirmed impact.

Technical appendix: indicators of compromise and TTPs

The Gentlemen and the observed attack chain

The campaign attributed to The Gentlemen showed an intrusion chain with initial access through Internet-exposed firewall interfaces, reconnaissance using Advanced IP Scanner, use of PowerRun.exe for privilege escalation, and ThrottleBlood.sys for defense evasion. The material also mentioned abuse of VPN gateways, firewalls, and unpatched remote access tools.

Explicit IOCs and artifacts in the material

The evidence laid out in the corpus did not provide verified hashes, IP addresses, or domains to add as a clean technical list. It did provide names of tools, drivers, and vectors: Advanced IP Scanner, PowerRun.exe, ThrottleBlood.sys, exposed FortiGate interfaces, exposed VPN gateways, and virtualized systems such as Linux, ESXi, and Hyper-V, along with Go backdoors and curve25519 and xchacha20 encryption in The Gentlemen's technical description.

Technical reading recommendation

For a blue team, the value of these signals is not in attribution, but in the pattern. If an organization exposes perimeter services, uses remote administration, and has weak segmentation between the administrative network and critical systems, the The Gentlemen case serves as a guide for defensive prioritization. The material does not include enough IOCs for a blocklist, but it does provide clear TTPs to strengthen detection and hardening.