Mining, Metals, Natural Resources, October 2026

Active Threats and Campaigns

The most visible active threat this month was extortion, though the real impact remains unclear. At the same time, there were signs of documented phishing and fraud, plus APT and intrusion activity with AI-assisted participation, although none of those lines was clearly tied to the extractive sector in every case.

Ransomware and extortion, Grupo Industrial Tauro

The only metallurgy case with a direct ransomware claim was Grupo Industrial Tauro. The most concrete source, Dexpose, said Lamashtu announced an attack and threatened to publish data if its demands were not met. Ransomware.live and Darkfield repeated the claim, but none of the sources showed independent technical evidence or confirmed asset encryption.

BreachSense added an important nuance by pointing to account and credential records associated with the grupotauro.com domain observed in external breaches. That may suggest weak identity hygiene or prior credential exposure, but it is not enough to assert victim compromise. In this report’s classification, the case remains an extortion claim with an undeterminable label.

The operational reading is that campaigns like this try to capitalize on a company’s public visibility and the reputational pressure created by a leak site. For the sector, the main risk is not only possible data loss, but also a break in trust with customers, suppliers and regulators if the company lacks a clear response and validation posture.

Ransomware and extortion, Warlock and the SharePoint chain

The month’s other extortion focus was Warlock, also identified by the source as Storm-2603. SC Media reported that attackers exploited on-premises Microsoft SharePoint vulnerabilities to gain initial access and disabled security software on 40 hosts in about two hours before deploying ransomware. WaterISAC added that water administrators should treat on-premises SharePoint servers exposed to the internet before patching as potentially compromised.

SECPod linked that activity to the four-vulnerability ToolShell chain in Microsoft SharePoint Server on-premises, including CVE-2025-53770, described as an unauthenticated remote code execution flaw with a CVSS of 9.8. Aviatrix and CyberScoop added tactical context: prior persistence, domain mapping, unauthorized service account creation and possible use of the same ToolShell chain or recent vulnerabilities. None of those pieces identifies a specific Latin American mining or metallurgy victim, but the vector is highly relevant for industrial operators with exposed SharePoint systems.

The implication is not theoretical. Many organizations in the vertical use SharePoint for intranet, supplier documentation, change requests and administrative workflows. If an attacker gets initial access there, they can move toward email, identity and management systems, even without touching the OT network at first. That entry point matches WaterISAC’s concern and the hybrid infrastructure profile that defines large operators.

Ransomware and extortion, the Cotesma mention

A third item this month was the publication of a purported Qilin attack against Cotesma in Chile, circulated by TweetThreatNews. The item said there was unauthorized encryption and operational disruption, but there was no official confirmation from the company or a Chilean authority, and the case was not specifically tied to mining or natural resources.

Methodologically, this type of record should be treated cautiously. The available material is not enough to move it up in classification or include it as a confirmed incident in the vertical. It does, however, serve as a reminder that repositories of alleged leaks or unvalidated posts can amplify noise and be mistaken for signal if they are not checked against primary sources.

Fraud and phishing

Documented evidence of fraud and phishing was limited in the material analyzed, with three cases in total according to the period indicators. The reference content does not break those episodes down one by one within the extractive vertical, but it does confirm that the tactic continued to appear during the month.

The lack of more detail does not mean the risk declined. In mining, metallurgy and natural resource environments, phishing often targets identity, procurement, vendors and remote access. When field operations, contractors and distributed communications are also involved, a fraud campaign can open the door to credential theft, payment diversion or lateral access to administrative platforms.

APT, automation and AI-assisted intrusion

CrowdStrike published information about a campaign of AI agents that allegedly affected at least 15 healthcare entities in Argentina, with credential and medical record exfiltration. Crypto Briefing and Becker's Hospital Review repeated the finding as an operation with limited human participation. Security Boulevard, for its part, reported activity attributed to VAPOR PANDA against Latin American government institutions with BLOODALCHEMY deployment, although without identifying public victims.

Those pieces do not show a direct link to mining or metallurgy, but they do indicate where advanced operations are heading. If AI-supported actors can increase scale, speed and persistence, the same model could eventually affect energy, logistics or public administration providers linked to concessions and permits. The risk for the vertical sits in the surrounding ecosystem, not only at the main perimeter.

Critical vulnerabilities

The critical vulnerabilities mentioned in October mainly affected collaboration software, remote access tools, and exposed applications, with several families under active exploitation. For this vertical, the value lies in third-party exposure and in systems that often sit alongside industrial operations, even if they are not always part of the OT core.

These vulnerabilities should not be read as a list of victims in the vertical, but as exposure points that can enable intrusion in industrial companies, service operators, and contractors. In an environment where operations depend on email, document management, remote access, and internal portals, delayed patching or internet exposure remains a priority entry point.

Regulation and Compliance

The month’s regulatory focus centered on Chile and the debate over critical infrastructure. The dispute between energy and mining companies and the cybersecurity authority shows that compliance is no longer just a paperwork issue, but a question of operational dependence and the legal classification of a service.

La Tercera reported that Sierra Gorda, Zaldívar, Antucoya and Centinela challenged the application of the regulatory category. Enex told the Santiago Court of Appeals that its processes are physical and mechanical, while Esmax acknowledged its status as a provider of essential services but rejected the stricter category of Vital Importance Operator. El Fondo added the authority’s position to the debate, underscoring the weight of telemetry, RFID payments and dispatch platforms.

The compliance signal is twofold. On one side, pressure is building for players in the sector to align with more demanding security frameworks. On the other, companies themselves are still disputing the scope of that obligation. For security teams, that means preparing technical evidence of digital dependence, continuity tests and criticality arguments based on real processes, not just the regulatory label.

Countries and Most Affected Subsegments

The month’s geographic distribution was uneven. Mexico, Chile, Colombia, and Costa Rica accounted for the cases most directly tied to the vertical or its operating environment, while Argentina and Panama appeared in contextual material on regional exposure and campaigns that may have affected third-party supply chains.

Mexico

Mexico had the clearest case of the month in metallurgy, with Lamashtu’s claim against Grupo Industrial Tauro in Monterrey. There was no independent confirmation of the intrusion, but the fact that a steel manufacturer appeared on a leak site already calls for a review of identity posture, asset exposure, and extortion response.

The available material does not allow for a concrete operational impact to be assigned, but it does place Mexico among the markets where digital extortion is trying to reach heavy industry. The relevance is not only domestic, because a steel manufacturer sits inside regional supply and maintenance chains that cross borders.

Chile

Chile was the country with the highest density of regulatory and compliance issues. The discussion there spans critical infrastructure, the mention of mining companies in litigation, the reference to a ransomware figure in the Secure Soft report cited by La Verdad, and the appearance of a purported Qilin case against Cotesma, although without official confirmation.

The key point in the Chilean case is that the mining sector is no longer framed only as a potential extortion target, but as an actor in a broader conversation about cybersecurity obligations. Authorities and companies are discussing the role of telemetry systems, payments, and automation, which points to a higher level of regulatory maturity than in other jurisdictions in the region.

Colombia

Colombia produced the most visible case of illegal mining using satellite connectivity. The operation in Antioquia showed how communications infrastructure can be used by criminal groups to sustain illicit production in remote areas. There was no classic cyber incident, but there was a direct link between connectivity and resource exploitation.

That pattern matters for the formal sector. Legal or illegal mining depends on communications, power, and traceability. When those capabilities are deployed in hard-to-reach areas, the line between productive logistics and criminal support can become blurred. For risk control, that means security, telecommunications, and field monitoring have to be managed together.

Costa Rica

Costa Rica appeared in INTERPOL’s operation against environmental crimes, with the seizure of cyanide and mercury used in illicit gold extraction. Although the event was not a digital incident, it does speak to the supply chain around illegal mining and to the importance of tracking routes, purchases, and logistics.

In a sector cybersecurity report, that reference is not decorative. It serves as a reminder that natural resources are exposed to hybrid networks of smuggling, communication, and coordination, where digital tools can support both supply and evasion of controls.

Argentina and the Rest of the Regional Environment

Argentina appears in the material as contextual background, with CrowdStrike’s reference to at least 15 healthcare entities affected by an AI-assisted campaign. This is not an extractive vertical event, but it is a signal of advanced risk reaching the region. TN and other background materials reinforce that Latin American industrial environments remain under intense and diversified pressure.

This month, the most visible subsegments in the vertical were metallurgy, fuels, and informal mining. Large formal mining appears more in the regulatory and compliance sphere than as a confirmed technical victim. That does not reduce the risk, but it does change the reading, because the most visible front is the dependency on digital services, third parties, and operational continuity.

Trends and signals to watch

The main comparison with the previous month is that verifiable volume fell from 49 to 40 incidents, while the dominant threat moved from 22 to 14 unclassified incidents. That points to less overall noise, but still a great deal of attribution uncertainty. There is no sign of structural relief. Instead, this is a narrower snapshot with more concentration in specific events.

The first trend to watch is ransomware with incomplete classification. September and October had the same number of cases with ransomware or extortion as the primary focus, eight in both months, but in October only one could be tied to confirmed encryption. The rest remained in a gray zone, which means leak sites and third-party claims need to be read carefully.

The second signal is exploitation of widely used software. October added two more CVEs mentioned than the previous month and showed active activity in Ivanti, Plex, PHP, Zimbra and SharePoint. For the industrial sector, the lesson does not change: remote access, internal portals and collaboration tools remain preferred entry points.

The third trend is regulatory. Chile is pushing a more concrete debate on which assets in the vertical should be treated as critical and what cybersecurity obligations apply. That discussion is likely to gain weight in other countries in the region if dependence on telemetry, automation and digital services keeps growing.

The fourth signal is the convergence of connectivity and illicit economies. The case in Antioquia and the seizure of supplies in Costa Rica show that satellite connectivity, autonomous equipment and coordination networks are also part of the natural resources problem. For security teams, this opens a monitoring front that goes beyond endpoints or servers.

Recommendations for security teams

Security teams in this vertical should prioritize measures that address the month’s most visible vector, the mix of extortion, third-party exposure, and dependence on digital services. There is no need to wait for a confirmed intrusion before acting on those surfaces.

First, review remote access and exposed collaboration platforms as a priority. The alerts on Ivanti, SharePoint, PHP, Plex, and Zimbra show that widely used software can become an entry point. If the organization uses any of those platforms, or relies on vendors that run them, it is worth validating patching, external exposure, multifactor authentication, and privilege segmentation.

Second, strengthen response to ransomware claims even without full technical confirmation. The Tauro case shows that a leak site can create pressure even when there is no public evidence of encryption. Legal, communications, and security teams should agree in advance on how to validate, deny, or narrow a claim, how to preserve evidence, and how to respond to threats of data publication.

Third, audit vendors and contractors that support industrial, logistics, or administrative operations. Most of the month’s entry points are not in the production core, but in adjacent services. In mining, metallurgy, and energy, that includes maintenance, ERP, telemetry, dispatch, document management, and remote support.

Fourth, reinforce controls over field communications and autonomous assets. The use of satellite internet in illegal mining in Colombia is not an isolated physical security case, but a sign that distributed communications are also part of the risk. Where there are satellite links, radios, solar panels, or autonomous equipment, there should be inventory, monitoring, and traceability.

Fifth, prepare evidence for regulatory discussions. The Chilean case shows that critical infrastructure classification depends on demonstrating interdependence between digital networks and physical operations. That requires real diagrams, continuity tests, telemetry logs, service maps, and documentation of the potential impact of a systems outage.

Sixth, monitor exposed identities and credentials in external breaches. BreachSense’s finding on accounts and credentials linked to grupotauro.com, although not proven to be part of the attack, suggests that credential lists remain a source of risk for the industry. It is advisable to review password reuse, MFA, anomaly detection, and rotation policies.

FAQ

What connects the Grupo Industrial Tauro case with the regulatory debate in Chile?

Both cases show dependence on digital systems in industrial settings, even though one is an extortion complaint in Mexico and the other is a regulatory dispute in Chile. Tauro highlights the risk of ransomware or a leak site, while Chile focuses on telemetry, payments, and dispatch as part of critical operations.

Why does illegal mining in Colombia appear in a cybersecurity report?

Because the material shows that connectivity and autonomous power also support illicit extractive economies. In Antioquia, the satellite antenna was not an incidental detail, but a communications piece for operational contact with ringleaders. That cuts across physical security, telecommunications, and territorial control.

Which vulnerabilities should teams in the vertical prioritize this month?

Those the material identifies as actively exploited and that often coexist with industrial operations, such as Ivanti Connect Secure, on-prem SharePoint, Zimbra, PHP, and Plex. The practical priority comes from the overlap between the vulnerability section and extortion incidents, because several entry vectors are cross-cutting.

Did the month show more confirmed ransomware or more unverified claims?

It showed more unverified claims. There were eight cases with ransomware or extortion as the primary focus, but only one had confirmed asset encryption and seven could not be clearly classified based on the material. That means leak sites should be treated as risk signals, not as automatic proof of impact.

Which country concentrated the highest density of signals for natural resources?

Chile, because of the mix of a regulatory dispute, references to mining companies, and debate over critical infrastructure. Mexico contributed the Tauro case, Colombia the use of connectivity in illegal mining, and Costa Rica the seizure of supplies for illicit extraction. Each country added a different part of the map.

Material limitations

This report was built exclusively from the material provided for October 2026 and the stated time window for the indicators. No external sources or content outside the approved list were used, and facts from prior months were considered only for the comparison already supplied in the source.

An indicator marked as zero does not mean the phenomenon is absent in the region. In particular, if a category of critical vulnerabilities or incidents did not appear in the material analyzed, that only means it was not recorded in this sample, not that it did not occur in Latin America.

The ransomware and extortion category was handled under the taxonomy requested by the instructions. When the evidence did not allow a distinction between asset encryption, exfiltration without encryption, or a mere mention on a leak site, the source was explicitly noted as not specifying the impact. No technical hypotheses unsupported by the material were added.

Telemetry aggregates were also not included as incidents. When a contextual reference was mentioned, it was clarified that these were vendor attempts, blocks, or measurements, not intrusions with confirmed impact. Any posts not in the list of available sources, or that depended on consumer social networks, were excluded from any count.