#Emperador
This archive brings together coverage of Emperador and its footprint within the cyberthreat landscape affecting Latin America. Readers will find reporting on observed activity, tactics, infection vectors, and links to campaigns that have reached organizations and users across the region.
Emperador posts OnTrac, Electrolux victims
Emperador added OnTrac and Electrolux to its leak site, claiming $1 million and up to 75.1 MB of exfiltrated data.
Sep 28, 2026 · 2 min
Brazil's Receita Federal cited by Emperador
Emperador claimed Brazil’s Receita Federal as a victim and said it had 6.3 GB of data. There is no official confirmation of a breach.
Sep 24, 2026 · 2 min
Jujuy Judiciary exposed by Emperador ransomware
Emperador leaked WordPress databases and credentials from Jujuy’s judiciary. The operation is still active and has another confirmed victim.
Sep 10, 2026 · 3 min
Jujuy Judicial Branch Faces Emperador Claim
Emperador says it breached Jujuy’s judiciary and demands 4.2 GB of data. SOCRadar, RecentBreaches, and Darkfield add context.
Sep 9, 2026 · 4 min
KRYBIT widens its campaign to Colombia
KRYBIT added 14 victims in 24 hours across 9 countries and more than 8 sectors, while CYFIRMA added Colombia and Chile as targets.
Sep 4, 2026 · 4 min
Arcos appears in Emperador leak
Brazil’s Arcos city hall appears on a leak site tied to Emperador, but the claim has not been independently verified.
Aug 19, 2026 · 2 min