Situación Nacional de Ciberseguridad - Junio 2026 - Colombia

Threats and active campaigns in Colombia

Ransomware and extortion in Colombia

The month was not defined by classic encrypting ransomware, but by extortion centered on data theft, remote access, and pressure on corporate victims. Silent Ransom Group was the most useful reference for understanding that shift. The reports cited by SOSRansomware, Rescana, SocPrime and TechCrunch describe a model that prioritizes vishing, phishing, legitimate remote access, USB devices, and even the insertion of people posing as IT technicians to gain physical access to offices.

In Colombia, that tactic matters because it fits professional services, BPO, education, health care and corporate environments, the same sectors Semana identified among the hardest hit during the May crisis and which kept appearing in June as higher-risk areas. There is no evidence in the material of a ransomware encryption incident in Colombia during the month, but there is evidence of sustained pressure on data and credentials that feeds extortion and fraud.

Fraud and phishing in Colombia

Fraud was the second major theme of the period. The Superintendencia Financiera launched the microsite "Protégete de los fraudes", focused on phishing, smishing and warning signs tied to digital financial transactions. The SIC, meanwhile, rolled out a campaign in response to the rise in identity theft in the country, supported by complaints received since 2022.

Law 2573 of 2026 strengthens this front by requiring identity validation, traceability and response mechanisms for impersonation, with direct effects on banks, fintechs, telecoms and retailers with lending capabilities. In June, the issue was no longer just a warning. Regulators began turning it into a process, evidence and response obligation.

APT, hacktivism and exposure campaigns in Colombia

There was not enough verifiable material to attribute a classic, nationwide APT campaign in June. There was, however, evidence of pressure aimed at public exposure, impersonation and disinformation. The electoral bulletin from ColCERT and Registraduría referred to fraudulent domains and bots, manipulated narratives with artificial intelligence, and credential findings in clandestine forums. It is a surface where hacktivism and criminal operations overlap without requiring major technical sophistication.

That mix also appears in the Defensores de la Patria leak. The dispute between a platform that denies the breach and media outlets that say they verified public access to the data creates a typical digital-pressure scenario, where the exposure of information serves political, reputational and operational purposes at the same time.

Critical vulnerabilities affecting Colombia

Regulation and compliance in Colombia

Law 2573 of 2026 and its impact on digital identity in Colombia

Law 2573 of 2026 was the month’s most sensitive regulatory change on fraud and identity. The law expands habeas data, privacy, and reputation rights in cases of identity theft, and requires financial institutions, fintechs, SEDPE, telecom operators, and credit merchants to put in place reasonable and sufficient controls to verify identity.

The strongest part of the regime is the dynamic burden of proof. If a person files a claim for identity theft, the institution must show that its controls worked. That shifts the center of the dispute, written procedures are no longer enough, their effectiveness has to be provable. In addition, the material from Facephi, Cuatrecasas, and DataCrédito Experian agrees that there are now mechanisms to suspend collections, correct negative reports, and provide specific treatment for victims of identity fraud.

SIC and the anti-identity theft campaign in Colombia

The Superintendence of Industry and Commerce launched a campaign to prevent digital fraud and warned about the rise in identity theft. Cuatrecasas also reported a draft resolution that amends Title V of the Single Circular, with new rules on certification of authorizations, blocking of information, prior notice before negative reporting, data retention, and annual reporting of complaints.

The practical takeaway for entities is straightforward. Compliance is no longer limited to document formalities. Institutions are now expected to respond to claims, keep authorization traceability, and apply differentiated treatment for fraud victims. The regulatory framework is becoming more aligned with the operational pressure created by the crime.

Health, transportation, and public administration in Colombia

Resolution 1058 of 2026 from the Ministry of Health adopted the National Health Quality Policy 2026 to 2035 and set standards for patient safety, data protection, and technical competence in remote services. Resolution 8150 from the Superintendency of Transportation, meanwhile, tied the processing of sensitive data, such as biometric and audiovisual data, to Law 1581 of 2012 and defined obligations for the data processor.

In the Presidency, Resolution 0419 promoted the strategic use of data, analytics, open data, and interoperability. Taken together, these measures show a public administration that is beginning to better organize data use, while also recognizing that the data requires stronger controls, traceability, and clearer limits.

Superintendency of Finance and internal control in Colombia

Resolution 0877 of June 11 created the roles of Information Security and Business Continuity Officer, and Personal Data Protection Officer within the Superintendency of Finance. It is a sign of institutional maturity, because it moves the security discussion from the technical level to corporate governance and compliance.

The same agency launched the "Protect Yourself from Fraud" tool, with practical tips to avoid phishing and smishing, and with an explicit reference to filing a complaint through CAI Virtual or the Prosecutor’s Office when a scam has occurred. The month’s financial agenda combined education, institutional design, and preventive regulation.

Most affected sectors in Colombia

The sectors with documented incidents in June were eight, but the distribution was uneven. Health, education, BPO and corporate continued to appear as the most exposed areas, according to Semana. The public sector also came under pressure from electoral ecosystem credentials, the FortiBleed campaign, and several resolutions aimed at improving controls and responsibility profiles.

At the same time, the financial sector stood out from both a regulatory and fraud perspective. Law 2573, the SIC campaign, and the Superintendency of Finance tool show that identity fraud is hitting that vertical head on. It is no coincidence that the month produced so many items on user verification, transaction validation, and report correction.

Health deserves special mention. On one hand, it was one of the sectors highlighted in regional incident reports. On the other, Resolution 1058 added requirements for care security, data, and remote service delivery. That suggests exposure is not only criminal, but also regulatory and operational. The sector needs to ensure continuity, confidentiality, and the validity of clinical information at the same time.

Transportation and public administration closed the list of visible areas in the period. The handling of biometrics, audiovisual materials, and surveillance infrastructure, along with the push for strategic data use in public agencies, reinforces the idea that June’s risks did not concentrate in a single vertical, but moved across layers of state management and critical services.

Trends and signals to watch in Colombia

There is no comparative baseline for this country, because this is the first archived period in this indicator format. For that reason, it would not be accurate to invent a month-over-month change. Even so, there are several signals to track closely starting in June.

The first is the growing weight of identity theft. The SIC, Law 2573, the Superintendencia Financiera and DataCrédito Experian all point in the same direction. Identity verification has stopped being a peripheral issue and has become central to anti-fraud compliance.

The second is the persistence of credential exposure campaigns and public leaks. The CNE case, the Defensores de la Patria leak and the indicators of compromise released by CC-CSIRT suggest that the credential front remains an important entry point. It also signals that the underground market remains active and interested in Colombian data.

The third is exposure at the technology edge. FortiBleed and references to actively exploited vulnerabilities show that perimeter devices, management systems and widely deployed platforms remain a priority for attackers. This applies both to the public sector and to companies with limited external visibility into their own assets.

The fourth signal is rising regional pressure. Semana and Portafolio already place Colombia among the most attacked countries in Latin America. That is not just a regional statistic, it is also a warning about volume, appeal for cross-border campaigns and the buildup of adverse signals in sectors with heavy digital dependence.

Security recommendations for teams in Colombia

First, review controls for exposed credentials, both in institutional accounts and third-party access. June showed that attackers continue to exploit leaks and stealer logs as operational inputs. Rotation, revocation, and monitoring for reuse should be top priorities.

Second, strengthen digital identity handling. Fraud, risk, compliance, and cybersecurity teams should work from shared metrics for validation, traceability, and impersonation response. If the organization cannot demonstrate controls, the new regulatory architecture leaves it in a weak position.

Third, review perimeter exposure and administration platforms. FortiBleed offered a clear example of how a widely deployed vendor can become a systemic risk vector. It is worth inventorying exposed interfaces, hardening, MFA, admin segmentation, and criteria for urgent patching.

Fourth, strengthen detection of phishing, smishing, and vishing. The Superintendence of Finance campaign and reports on Silent Ransom Group show that the human factor remains critical. Teams should combine training with controls for email, messaging channels, and stronger authentication.

Fifth, formalize response to leaks with regulatory impact. It is not enough to investigate the incident, evidence must be preserved, legal leadership activated, and external communication defined. In a month like June, when public exposure of databases and debate over the authenticity of the leak were both in play, response speed matters as much as technical quality.

Material limitations

The report was written exclusively from the material provided. No internet search was conducted, and no external sources outside the authorized list were used.

There is no comparative baseline for the previous month, so no quantitative month-over-month trends were built. Comparisons are limited to a qualitative reading of the period and to regional references contained in the sources.

Some of the material is presented as attributed by the source or with an explicit degree of uncertainty, so in those cases cautious wording and consolidation of confirmed facts were prioritized. When the source did not allow a point to be verified, it was not treated as certain.

Technical appendix: indicators of compromise and TTPs

CC-CSIRT Information Bulletin No. 038 reported multiple indicators of compromise linked to malware campaigns in Colombia, and PMU Ciber Electoral 2026 Bulletin No. 005 issued recommendations on credential rotation, multifactor authentication, and stronger monitoring against impersonation and account exposure. In addition, the consolidated material on Silent Ransom Group describes vishing and phishing TTPs, abuse of remote access tools, use of RMM, USB, and concealed physical access by fake support technicians. In the case of FortiBleed, the source highlighted exposure of management interfaces and credential abuse on Fortinet devices.