Co-founder of Whalemate and head of Whalemate Labs. He signs CiberLATAM editorial investigations on APT groups, ransomware and the human factor in cybersecurity, and hosts the Capa 8 podcast.
Signed stories
Chile, Mexico and Colombia tighten controls
New privacy, AML and open finance rules advance in Chile, Mexico and Colombia, with different deadlines, sanctions and technical standards.
Oct 5, 2026 · 37 min
Peru's BCRP regulates digital payments
The BCRP approved rules for acquiring and fund collection. It requires segregated funds, transparency, and takes effect Jan. 1, 2027.
Oct 5, 2026 · 38 min
FamousSparrow Uses SparroWocky in Latin America
ESET links FamousSparrow to a SparroWocky campaign against Latin American governments, with eight territories and 90% of targets in the region.
Sep 28, 2026 · 38 min
Brazil sets PSAV rules and crypto reporting for 2026
Brazil set a PSAV authorization deadline and added COAF reporting for crypto transfers of $10,000 or more, with controls starting in 2026.
Sep 28, 2026 · 38 min
FamousSparrow Uses SparroWocky Against Latin America
ESET links a regional spying campaign to FamousSparrow and its new SparroWocky backdoor, with Peru among the targets.
Sep 21, 2026 · 42 min
Chile, Mexico and Brazil tighten PLD rules
Chile, Mexico, Brazil and others are speeding up new data, fraud, cybersecurity and virtual asset rules through 2028.
Sep 21, 2026 · 37 min
Brazil malware swaps Pix QR codes in e-commerce
Kaspersky found 90 Brazilian stores infected with malware that replaces Pix QR codes and Pix Copia e Cola at checkout.
Sep 14, 2026 · 38 min
Paraguay data law expands crypto reporting
Law 7593/2025 and RG 47/2026 expand data and crypto controls in Paraguay, adding obligations, sanctions, and proportionality debates.
Sep 14, 2026 · 37 min
Mexico, Brazil, Ecuador in CL-CRI-1131, 1163
Unit 42 tracked two AI-assisted intrusion clusters in Mexico, Ecuador and Brazil, using NextChat, Claude
Sep 7, 2026 · 38 min
Unit 42 Tracks CL-CRI-1131
Unit 42 found two AI-linked clusters targeting governments, water, and banks in Mexico, Ecuador, and Brazil since February 2026.
Sep 7, 2026 · 36 min
Brazil BCB 519, 520, 521 and 584 for PSAV
Brazil tightened PSAV rules on licensing, capital, audit and a 24-hour hold for higher-risk crypto transfers.
Aug 31, 2026 · 36 min
Chile's Law 21,719 on Personal Data
Chile’s Law 21,719 takes effect Dec. 1, 2026, creating a new agency, stronger rights, fines up to 20,000 UTM, and GDPR-like rules.
Aug 31, 2026 · 36 min
Brazil’s BCB 766 updates Pix MED
Brazil updated the Pix DICT manual with deeper tracing, an 80-day response window, and new MED 2.0 adjustments.
Aug 24, 2026 · 38 min
The Gentlemen ransomware hits LATAM
The Gentlemen grew into a double-extortion RaaS in 2026, targeting LATAM with Fortinet, RDP, and attacks in Colombia, Peru
Aug 17, 2026 · 39 min
Brazil ANPD suspends Discord live streams
Brazil’s ANPD opened a probe into Discord over child safety risks and ordered Go Live and similar live video features suspended.
Aug 17, 2026 · 38 min
US Water Attacks Hit 12 States, NY Funds Defense
Water attacks in the U.S. affected at least 12 states. New York is funding 153 systems as Latin America exposes energy gaps.
Aug 10, 2026 · 38 min
Mexico: 200 AI Bills, No Federal Law
Mexico has nearly 200 state-level AI proposals, but no federal general law or corporate cybersecurity framework yet.
Aug 10, 2026 · 38 min
Brazil Open Finance and Deepfake Fraud
Evertec shows how Open Finance, Pix and facial biometrics are creating new fraud paths in Brazil, and how banks and regulators are responding.
Aug 3, 2026 · 38 min
OpenAI and Hugging Face Intrusion
OpenAI confirmed a sandbox escape during an internal test that hit Hugging Face and exposed credentials across four external services.
Aug 3, 2026 · 38 min
CVE-2024-24919 in Check Point Gateways
CVE-2024-24919 exposed Check Point gateways to credential theft and was used in ransomware and APT campaigns, with regional relevance for Brazil.
Jul 27, 2026 · 38 min
Brazil Central Bank classifies PSAVs as Type 3
Brazil’s BCB 580/2026 brings virtual asset service providers into the prudential regime, with capital rules and a transition through 2028.
Jul 27, 2026 · 39 min
Mercado Libre listed by The Gentlemen in July 2026
The Gentlemen listed Mercado Libre on its leak site in July 2026. Exfiltration signs emerged, but no public proof of operational impact.
Jul 20, 2026 · 38 min
ColCERT Warns on ORB3 CHARLIE Network
ColCERT says ORB3/CHARLIE is used for espionage against telecom and critical infrastructure in South America, with 16 nodes
Jul 13, 2026 · 36 min
Latin America Leads AI Synthetic ID Fraud
Latin America accounts for 48.3% of AI-driven synthetic identity fraud. Banks and fintechs face weaker remote onboarding controls.
Jul 13, 2026 · 38 min