Paraguay expands Chinese cyberespionage complaint

Update August 25, 2026: Paraguay and the United States issued a joint statement on July 10 after a cybersecurity review of Paraguayan government networks, and prosecutors later opened a criminal case based on MITIC's complaint. China publicly rejected the allegations and called them slander.

APT campaigns in the region

The Andean Agency released a cybersecurity alert for Latin America warning about advanced persistent threat, or APT, attacks aimed at government entities and companies in the region. According to the advisory, the campaigns include infiltration of organizations through fake identities created with artificial intelligence to gain access to internal networks and sensitive data.

The warning comes amid other regional coverage and cybersecurity reporting describing sustained activity by groups able to remain inside compromised networks and operate with espionage objectives.

Paraguay, China, and public attribution

In Paraguay, on July 10, 2026, the governments of Paraguay and the United States issued a joint statement on a cybersecurity review that detected multiple threat actors linked to the Chinese government who had allegedly infiltrated Paraguayan state systems. ABC Color reported that the review focused on Paraguayan government networks and that the official statement referred to "malicious cyber operations" targeting state digital platforms, without publicly detailing which institutions were affected or which technical vectors were used.

A post from radio station Ñandutí had reported that the Ministry of Information and Communication Technologies and the U.S. Embassy issued a joint statement accusing actors linked to China of cyberattacks against the country’s infrastructure. That post, however, did not identify specific victims or confirm a public technical attribution.

Other coverage repeated on social media added more context around the same episode. Infobae said the cyber intrusions attributed to actors linked to China allegedly affected Paraguayan state systems, while Milenio Diario described China-linked espionage networks in Paraguayan systems and called them an advanced threat. Noticias al Día, for its part, said Paraguay and the United States were denouncing Chinese cyberespionage in state networks, still focused on government infrastructure and without naming specific agencies.

On July 13, 2026, according to coverage cited in a secondary report, Paraguayan MITIC minister Gustavo Villate filed the formal complaint. The next day, prosecutors opened a criminal case handled by prosecutor Irma Llano. ABC Color said Attorney General Emiliano Rolón Fernández ordered the case opened and assigned the specialized cybercrime prosecutor, and clarified that the investigation is tied to the joint MITIC and U.S. Embassy review released on July 10.

What did China and its spokespeople say?

China rejected the Paraguayan complaint and called it slander. ABC Color reported that the Consulate General of the People’s Republic of China in São Paulo, acting as the concurrent office for Paraguay, issued a statement saying the allegations lacked "valid evidence," accused the United States of being the "leading practitioner" of global cyberattacks, and described the conduct of Paraguay and the U.S. as "extremely irresponsible" and a "distortion of the facts."

The official Chinese news agency Xinhua, citing Foreign Ministry spokesperson Lin Jian at a press briefing, said China strongly opposes the United States using cybersecurity to "slander and contain" other countries. The spokesperson denied responsibility and framed the issue as part of a broader pattern of political weaponization of cybersecurity.

A summary from Última Hora said the Chinese consulate in São Paulo posted its statement on X, accusing MITIC and the U.S. Embassy of "slandering" China over alleged malicious cyber operations and expressing its "deep dissatisfaction and firm opposition." That same report described it as a direct response to the Paraguayan-U.S. joint statement of July 10.

Persistence and vulnerable networks

A news item on Instagram about the joint U.S. and Paraguay investigation said the Chinese APT group would be deploying new malware to maintain persistence in compromised networks. According to that content, once access is gained, the group installs components to stay in place for long periods and keep exfiltrating information.

In the same vein, a reel from ESET Security Days 2026 said, citing ESET's latest report, that there had been increased activity from a network associated with state-linked Chinese actors using vulnerable network devices for cyberespionage operations in Latin America. El Toque expanded on that point, saying network devices in several Latin American countries are being used for espionage and cyber reconnaissance operations by a network associated with state-linked Chinese actors.

Another ABC Color report in the politics section said Paraguay's Chamber of Deputies approved a request for information from MITIC after the joint statement on "Malicious Cyber Operations by China directed at the Government of Paraguay," and asked, among other things, for the full text of the official MITIC-U.S. government statement. That suggests the full text of the official notice had not been reproduced in full by the media at the time of coverage.

Última Hora also reported that, according to data attributed to CERT-PY, nearly 4,000 cyberattacks or incidents have been recorded since 2023, and tied those figures to the MITIC-U.S. joint statement, although the article did not provide a detailed breakdown of reports versus incidents or sector-specific figures.

Taken together, the reports point to campaigns centered on persistence, access to critical infrastructure, and the collection of sensitive information, using a pattern that combines fake identities, malware designed to stay active, and the exploitation of vulnerable network equipment.