Paraguay Cybersecurity Update: October 2026

Relevant incidents in Paraguay

Municipality of Asunción and Citizen Service WhatsApp

The Municipality of Asunción confirmed unauthorized access to its official Citizen Service WhatsApp account, temporarily lost control of the line, and asked people not to reply to messages or open links sent from that number. The case is the clearest incident this month of an institutional account compromise and ties into the broader WhatsApp theft campaign observed in Paraguay.

The source did not publish technical indicators, domains, or hashes, so the significance of the case lies in the institutional confirmation of the compromise and the public response. Operationally, the main impact was impersonation and the resulting fraud risk, not disruption to critical infrastructure.

UNA, Supreme Court, and the threatening email

The National University of Asunción and the Supreme Court responded to a threatening email that triggered security protocols, inspections, and a temporary suspension of in-person activities on campus. Police preserved digital headers and analyzed associated links, but the material does not confirm an intrusion into internal systems or malicious execution on the affected infrastructure.

The episode matters because of the coordinated response between public forces, the university, and the Judiciary. It also shows an email-based pressure tactic that forced an immediate crisis response, while the public evidence did not support going beyond preventive investigation.

Electoral Justice and preventive suspension of PHP sites

The Superior Tribunal of Electoral Justice temporarily suspended sites and systems developed with PHP after CERT-PY alerts about two critical vulnerabilities. The measure was preventive and temporary, and it was based on international reports of active exploitation of CVE-2026-109618 and CVE-2026-109619.

There is no evidence in the material of a confirmed compromise in Paraguay’s electoral environment, but there is a clear sign of technical exposure sufficient to justify containment. The speed of the response contrasts with other cases in the period, where the damage had already been done.

DNIT, institutional impersonation, and fake auction page

DNIT warned about a fake auction site that used its institutional image to request personal data. The agency clarified that it did not operate or endorse that portal, placing the incident in the realm of phishing and brand impersonation, not a confirmed internal breach.

This case matters because it expands the map of institutional identity abuse beyond WhatsApp. It also reinforces October’s pattern, which combined fraud through digital channels, deceptive messages, and exploitation of public trust.

Threats and active campaigns in Paraguay

Ransomware and extortion in Paraguay

The ransomware and extortion campaign produced eight cases during the period, but in five of them the source did not make it possible to determine whether there was encryption, exfiltration, or only a mention on a leak site. That ambiguity is central to reading the month, because the available material mixes actor claims, intelligence records, and partial confirmations without public technical proof of impact.

The clearest confirmed encryption case is not detailed in the material with the same level of evidence as other claims, while MyM ODONTOCLINICA S.A. and Tape Ruvicha appear as claims attributed to ransomware groups, without independent validation from the victim. Alianza Paraguay also appears in an intelligence record, but the source itself clarifies that it does not confirm intrusion details, exfiltration, or operational impact.

MyM ODONTOCLINICA S.A. and Emperador

DeXpose, Yazoul Security, and Ransomware.live attributed a claim against MyM ODONTOCLINICA S.A. to Emperador, with a supposed exfiltration of 2.9 GB and references to financial documents, personal data, and customer data. None of those sources independently confirmed the intrusion, encryption, or exfiltration in verifiable terms.

The prudent reading is that this is a leak site mention with possible exposed data, but not a confirmable case of operational impact in Paraguay. The most detailed source remains declarative rather than evidentiary.

Tape Ruvicha and Qilin

Qilin claimed an attack against Tape Ruvicha and threatened to disclose sensitive information if negotiations did not begin. The available material does not provide independent confirmation from the affected organization or evidence of exfiltration or encryption.

For that reason, this episode should be read as an extortion allegation attributed to the actor, not as a verified breach. It is a useful signal for monitoring, but not yet a fully classified incident with proven impact.

Alianza Paraguay and ddosecret

A Dark Eye record attributed a claim against Alianza Paraguay to ddosecret, classified within the financial sector, without detailing the amount, data volume, encryption, or confirmation of compromise. The source does not provide elements to distinguish whether the case involved encryption, exfiltration, or only the publication of a claim.

In threat intelligence terms, it serves as an indication of actor interest in Paraguay's financial sector. In incident terms, the material is still insufficient for more than a cautious observation.

Fraud and phishing in Paraguay

The documented fraud during the period had two sides, the deception using AI-generated images to try to open digital accounts at Banco Atlas, and the scam tied to a fake credit offer for people listed in Informconf. To that was added the DNIT warning about the fake auction page.

This was not a single campaign, but a pattern of social engineering that exploits trust in digital channels, social networks, and messaging apps. The difference between the cases lies in the final target, opening an account, collecting an advance payment, or requesting personal data, but the manipulation logic is the same.

APT and hacktivism in Paraguay

The month included a state-level signal with the joint statement from MITIC and the Government of the United States on malicious cyber operations linked to the People's Republic of China and directed against Paraguayan state institutions. The material adds no IoCs or detailed technical attribution, but it does raise the geopolitical tone of the national debate.

No campaign attributable to local hacktivism appears in the period with enough public evidence. The weight of the month on this axis was concentrated in the institutional communication on state threats and the defensive response from the public sector.

Critical vulnerabilities affecting Paraguay

Both flaws are critical and allow remote code execution without authentication in PHP installations that serve web requests. For Paraguay, the most relevant operational detail is not only the bug itself, but the Electoral Justice's preventive decision to shut down systems while it assesses the risk.

Regulation and compliance in Paraguay

Paraguay saw a month of strong regulatory momentum in October, with a focus on data protection, crypto assets, supply chains and institutional oversight. Implementation rules for Law No. 7593/2025 were still pending, while MITIC said the law will take full effect on November 27, 2027, and that the final draft will be submitted for comments.

The debate was not purely technical. ABC Color and Última Hora reported concerns about where the data authority would sit within MITIC, the possible conflict between supervision and state digitalization, and the use of the law to deny access to public information. It was also noted that the law provides for a specialized agency with functional autonomy and the rank of a national directorate.

Tax regulation also took up space. DNIT reminded companies of the obligation to report crypto assets through the Marangatu system and on the RUC, while the Cámara Paraguaya de Fintech questioned the operational scope of the resolution. That regulatory front sits alongside the fake auction page case, which shows how institutional identity can be used to extract personal data outside official channels.

In the financial sector, the BCP warned about Broker Mercosul, which is not authorized as a brokerage house, and detailed a scheme that used websites and Telegram to promise profits and demand additional deposits. That warning, together with other supervisor clarifications on fraud and technological risks, reinforces the view that user protection became a visible regulatory priority during the month.

Sectors Hit Hardest in Paraguay

The financial sector saw the most activity by volume and variety, though not all of it was a technical incident in the strict sense. It included the Broker Mercosul case, the fraud tied to bank accounts, the threat against Alianza Paraguay, and the regulatory spotlight on cryptoassets. The sector combined scams, regulatory pressure, and exposure to ransomware claims, which explains its weight in the month.

The public sector also had a strong presence. Asunción’s city government, DNIT, the Electoral Justice system, MITIC, and the Judiciary itself appeared in separate cases, with varying levels of impact. In some cases, accounts or portals were confirmed compromised; in others, only preventive response, regulatory warnings, or official communications about threats were reported.

Education and justice shared one episode through UNA and the Supreme Court. Although it began as a threat by email, it ended with activity suspensions, patrols, and formal complaints. That overlap shows that digital crisis management in Paraguay is not confined to a single vertical.

Health, agriculture, and specialized services appeared with lower volume, but not with less relevance. The claims attributed to MyM ODONTOCLINICA S.A. and to supposed databases linked to SENAVE and the Ministry of Health, although unconfirmed, put those sectors on the monitoring radar.

Trends and signals to watch in Paraguay

Compared with September, October had fewer total events, fewer unclassified incidents, less ransomware as the primary focus, less fraud, and fewer regulatory moves. The numerical decline should not be read as lower risk, because the dominant threat shifted from ransomware to unclassified, and the share of direct confirmation remains limited. In other words, the month was quieter, but not necessarily safer.

The sharpest downward trend was ransomware. It fell from 19 of 63 events in September to 8 of 48 in October, with less claim density and more ambiguous material. The other side of that picture is that the month left several claims without enough technical validation, which points to an environment where threat-intelligence noise weighs more heavily than public confirmation of harm.

The second signal was WhatsApp’s consolidation as a spoofing vector. The pattern is not new, but this month brought more institutional evidence, more local coverage, and a confirmed case in a municipality. If that dynamic continues, messaging should be treated as an operational fraud surface, not just a support channel.

In vulnerabilities, October was more severe than other months because of the combination of active global exploitation and local preventive response. Paraguay was not isolated, and the action taken by the Electoral Justice shows that international warnings are already turning into domestic containment. That is a positive sign of defensive maturity, although it still depends on how quickly warnings are received.

Compared with September, quantified regulatory pressure also declined, but the density of institutional debate increased. The discussion on personal data, the electoral roll, the supply chain, and cryptoassets produced fewer announcements and more friction over design, scope, and the competent authority.

Recommendations for security teams in Paraguay

Strengthen account recovery controls across messaging channels. The WhatsApp pattern showed that voicemail, verification codes, and social engineering remain the most exploitable entry points. In companies and public agencies, review reset policies, enable two-step verification, and remove unnecessary voicemail dependencies.

Apply strict segregation between institutional and personal accounts. The Asunción Municipality case shows that a single compromised number can become a vector for impersonation and fraud against third parties. Teams that handle citizen services should have alternative workflows, anomaly alerts, and preapproved messages ready to quickly shut down abuse.

Patch PHP without delay and prioritize external web exposure. The CVE-2026-109618 and CVE-2026-109619 vulnerabilities were actively exploited and led to a preventive disconnection in Paraguay's electoral sphere. If immediate patching is not possible, reduce exposure temporarily, review public-facing front ends, and verify the real inventory of PHP applications.

Review response procedures for threats involving email and attachments. UNA and the Supreme Court had to respond with inspections, header preservation, and coordinated verification with public forces. That kind of incident requires clear protocols for evidence preservation, internal communication, and escalation with cybercrime units.

Strengthen brand and identity verification for fake sites and campaigns. DNIT, BCP, and other entities were exposed to impersonation or scam attempts using their names. A monitoring program for typosquatting, fake accounts, and mirror pages should be part of standard security and communications operations.

Frequently Asked Questions

What changed between ransomware pressure and WhatsApp pressure in Paraguay during October?

Ransomware pressure fell in volume compared with September, but WhatsApp-based manipulation became more operationally significant because it affected users, businesses, and a municipal government. A cross-reading of the threats and incidents sections shows a month less centered on extortion through leaks and more on impersonation.

What is the link between PHP vulnerabilities and the response from Paraguay's Electoral Justice system?

Paraguay's Electoral Justice system temporarily took sites and systems offline after warnings about CVE-2026-109618 and CVE-2026-109619, while PHP and international organizations confirmed active exploitation. The vulnerabilities table and the incidents section show the response was preventive, not an admission of intrusion.

Which Paraguayan sectors were most exposed to fraud and extortion at the same time?

The financial sector was the most exposed because it faced scams, regulatory alerts, and ransomware complaints in the same month. The sectors section and the threats section also show that the public sector and retail carried the burden of institutional impersonation and digital fraud.

How are personal data regulation and alerts about fake pages or non-consensual affiliations connected?

The data protection law and its pending regulation address consent, use of the voter registry, and correction of information, while the DNIT and other coverage showed fake pages and risks tied to improper data use. The regulatory section and the fraud section point to the same problem, identity and consent management across digital channels.

What operational lesson does the month leave for teams that manage public portals?

They should assume that a vulnerability notice, an email threat, or a brand impersonation can trigger a public response within hours. The combined cases involving Paraguay's Electoral Justice system, UNA, the Supreme Court, and the Municipality of Asunción show that operational continuity depends on patching and crisis coordination alike.

Material limitations

This report was built exclusively from the material provided for October 2026. The time window for the indicators is 48 dated events in October 2026, and the base for all indicators is that same series. No sources outside the allowed list or the open internet were used.

An indicator at zero, especially in CVEs or any unobserved category, means it was not recorded in the material analyzed for the period, not that it did not exist in Paraguay or in the region. The same applies to the absence of certain typologies or sectors in some modules: it reflects documentary coverage, not the nonexistence of the phenomenon.

The report excludes aggregated telemetry, attack attempts, automatic blocks, and vendor averages that do not constitute incidents. It also leaves out not permitted sources, such as consumer social networks and publications that are not on the list of enabled sources. When the material attributes a claim without independent confirmation, it is presented as such and not as a verified breach.