Latin America Ransomware Activity, June 2026

Active threats and campaigns

Ransomware and simple extortion

June’s roster of active groups shows a scattered but sustained pattern. TheGentlemen was identified by Breachsense as the month’s most active group with 94 claimed victims worldwide, and its activity overlaps with the Brazilian cases of Silmquinas e Equipamentos and Mackay Sugar mentioned by Kaseya. LockBit5 appears in Daniel Donda’s reporting and in the Mexican victimization of idefeey.yucatan.gob.mx and sweetome.com. Krybit appears repeatedly in Brazil, Paraguay and Mexico. Direwolf, Threeam, Gunra, Incransom, Stormous, Dragonforce and Killsec also appear.

Taxonomically, extortion is the dominant signal. The material allows for only one confirmed file-encryption case, the Paraguayan healthcare block, and one exfiltration case without encryption on the Mexican domain impulso-store.com. There is also a single victim mention on a leak site with no data published yet, as in the case of Mackay Sugar flagged by Kaseya. The remaining 53 incidents do not allow for a precise determination of whether there was encryption, leakage, or both. That opacity is a finding in itself, in June public visibility far outpaced technical precision.

TheGentlemen’s presence is especially useful for reading the month. Breachsense places it at the top of global activity, and Kaseya’s source shows a classic leak-site pattern, naming the victim before any data is published. That fits a staged pressure strategy. First the name is exposed. Then the response is measured. Later, if the victim does not negotiate, data publication or a second wave of exposure can follow.

Confirmed encryption, exfiltration without encryption, and only a mention

The distinction is not cosmetic. When encryption is confirmed, the impact appears in downed systems, halted processes and technical recovery. When there is exfiltration without encryption, the risk shifts to compliance, privacy and exposure-based extortion. When there is only a leak-site mention, the organization is already under public pressure, even if there is still no proof of a breach. June was dominated by the third scenario and, to a lesser extent, the second.

The Paraguayan case shows the first scenario relatively clearly, because institutions had to return to paper and operate manually. The impulso-store.com case shows the second, with access to complete customer and buyer data, as well as designs and orders. The Mackay Sugar case shows the third. That sequence matters for any regional CISO, because it requires severity indicators to be adjusted. The same group may be negotiating, leaking or encrypting depending on the target and the victim’s defensive maturity.

Fraud and phishing

Although this report focuses on ransomware, the material includes a specific signal of fraud and phishing. ITware Latam, based on the Fortinet 2026 Report, said phishing accounts for 76% of the attack vectors identified by industrial organizations in Latin America. CronUp, for its part, reported infostealer campaigns distributed through fake Spotify Premium promotions and pirated games. These are not ransomware, but they are part of the ecosystem that feeds initial access, credential theft and compromises that can later lead to extortion.

The link to ransomware is direct from an operational standpoint. Phishing campaigns and exposed credentials remain among the most profitable access paths for actors who then deploy data theft, persistence and lateral movement. June’s file does not document a major standalone fraud campaign with confirmed corporate victims in Latin America, but it does confirm that phishing remains central to the attack chain.

APT and critical infrastructure

The material analyzed does not include a classic APT campaign with enough detail to make it the main section. It does, however, point to a converging reading of critical infrastructure and operational continuity. Cyberix.cl reported alerts from Latin American CSIRTs about an escalation in ransomware aimed at compromising essential services. eSoft and ColCERT reinforce the picture of quieter intrusions, with compromised identity and automation, while Banxico shows how sensitive financial systems are to any disruption.

In other words, June does not bring a major classic APT case with formal attribution, but it does show a persistent intrusion environment in which ransomware acts as a strategic pressure tool against essential sectors. The operational result can resemble that of a prolonged access campaign, even if the monetization logic is different.

Critical vulnerabilities

No critical CVEs were recorded in the June material analyzed. That does not mean there were no exploited vulnerabilities in the region, only that the available corpus for this report did not include verifiable critical CVE identifiers.

Regulation and compliance

June also left a regulatory signal that should not be separated from the operational picture. ITware Latam reported that 89% of industrial leaders surveyed in Latin America expect cybersecurity regulations to increase over the next five years. That is not a specific rule issued this month, but it is a broad enough view to show the issue is no longer purely technical.

Banxico is the clearest case on compliance and oversight. The authority confirmed that cyber incidents in Mexico's financial system doubled in 2026 compared with 2025 and said the first event of the year was ransomware. That puts financial institutions under closer scrutiny for continuity, reporting, and operational resilience. The public debate generated by those figures could lead to stricter demands for controls, segmentation, and traceability.

At its core, June showed a clear convergence between technical risk and regulation. When an attack forces an organization back to paper, or when a bank sees electronic transfers interrupted, the issue stops being only about security and becomes one of corporate governance, compliance, and resilience. That is why the region's regulatory focus should not be limited to incident notification. It should also cover recovery times, third-party dependence, identity management, and realistic continuity testing.

Countries Most Affected in Latin America

Brazil

Brazil stands out as one of the month’s main hubs. Breachsense attributed 18 ransomware victims to it in June, and Daniel Donda lists five Brazilian organizations on extortion sites. That is reinforced by Krybit’s claim against Coemi Imóveis and TheGentlemen’s mention of Mackay Sugar. The sector mix is broad, including business services, transportation and logistics, healthcare, manufacturing, and consumer services.

The most important point is not just the number of names, but the persistence of public exposure. Brazil remains a profitable target for groups running leak sites, because the scale of its economy and the digital footprint across multiple sectors increase the leverage available in negotiations. The material does not let us determine how many of those cases involved confirmed encryption, but it does show that the country absorbed a significant share of the month’s pressure.

Mexico

Mexico has the highest density of specific cases in the file. Ransomware.live records victims such as Copamex, csinsurance.mx, impulso-store.com, jktornel, idefeey.yucatan.gob.mx, ford.mx, and acemacon.org, tied to several different groups. The financial sector also stands out, with Banxico confirming eight incidents in 2026 through May and a reference to LockBit ransomware against a bank in January.

The mix of victims points to a wide attack surface, spanning industry, insurance, retail, education, state infrastructure, and financial ecosystems. The country does not show a single threat pattern, but rather multiple campaigns and groups. That raises the level of complexity for defense teams, because it requires tracking exposed services, credentials, vendors, and remote administration surfaces.

Paraguay

Paraguay saw the month’s strongest operational impact. Sanatoriums and private medical companies had to shift to manual operations, and local coverage describes delays in care, tests, payments, and admissions. The incident also reached an industrial company, ERSA, attributed to Krybit. That two-front hit, healthcare and industry, shows that extortion is not limited to large economies or to a single sector.

The country deserves close attention because the material shows concrete operational impact. When continuity of care and administrative processes are affected to the point that paper becomes necessary again, the priority shifts from prevention to response. The sources do not allow us to confirm the scope of exfiltration, but they do confirm that the operational damage was significant.

Colombia

Colombia does not include in this file a confirmed ransomware victim comparable to the cases in Brazil, Mexico, or Paraguay, but it does provide key context. ERC Colombia, cited by Infobae, reported more than 10 billones of cyberattack attempts in the last year and a significant share of successful incidents in the region in May. It also pointed to impacts across healthcare, education, BPO, and corporate sectors, placing the country in a constant pressure environment.

Colombia matters for this report not because of the number of published cases, but because of what it says about the operating environment. When compromised credentials, application vulnerabilities, and webshells appear as recurring vectors, the path from intrusion to extortion gets shorter. The average cost of a data leak cited by ERC Colombia also helps explain why ransomware continues to attract attackers.

Chile

Chile appears indirectly in the material, through El Heraldo de Puebla’s report on a campaign attributed to Qilin that would also have affected a Chilean clinic. However, the source itself marks that attribution as uncertain. For editorial integrity, this report does not turn that mention into a confirmed June case. What it does show is a signal that healthcare sectors across the region remain on the radar of international groups.

In practical terms, Chile does not add a verifiable victim here with the same documentary weight as other countries, but it remains part of the regional exposure picture. The most prudent reading is one of watchfulness, not counting.

Argentina

Argentina does not appear in the month’s confirmed ransomware incident volume with a clear individual case in the file, although it does appear in earlier comparative material on cyberattack pressure per organization. That does not allow any inference about June volume. It does suggest a regional environment in which more connected economies face high and persistent exposure.

For this report, Argentina remains a country without a clearly documented ransomware victim in the June material, but still among the jurisdictions that need close monitoring for the same mix of phishing, compromised credentials, leak sites, and pressure on essential services.

Bolivia, Peru, and the United States

Bolivia and Peru do not have sufficiently detailed ransomware victims in the June file for a country-by-country reading. Regional references do appear, such as the list of Krybit victims, which includes aisem.gob.bo, but that mention comes from a monitoring source that does not break out a comparable Peruvian case. The United States, for its part, appears only indirectly in comparative or contextual material and is not part of the month’s regional volume.

Trends and signals to watch

There is no archived comparison baseline for June in this indicators format, so it is not appropriate to discuss month-over-month change using a single metric from the report. A qualitative trend can still be drawn from the available facts. The first is the consolidation of leak sites as a central pressure point. TheGentlemen, Krybit, LockBit5, Direwolf, Threeam, and other groups do not just post victims. They build a coercive narrative that mixes the organization’s name, a threat to leak data, and, at times, partial details about the data.

The second signal is the persistence of highly sensitive sectors. Health care and finance remain at the center of operational harm, but June also includes industry, manufacturing, logistics, education, and public or mixed infrastructure. That suggests attackers are still targeting places where operational stoppages are costliest. The manual response by Paraguayan sanatoriums and Banxico’s reference to a temporary interruption of transfers are two different examples of the same logic.

The third signal is that initial access remains the main enabler. Context sources point to exposed credentials, poorly secured remote services, automated exploitation, and phishing. It does not take a sophisticated exploit to turn a broad environment into an extortion case. In June, several parts of the material point to exactly that, intrusions driven more by identity abuse and exposed attack surface than by critical vulnerabilities with explicit CVEs.

The fourth signal is the growing weight of groups with multiregional activity. Krybit appears in Brazil, Paraguay, and Mexico. TheGentlemen leads the month globally in volume and touches a Brazilian case. LockBit5 reappears in Mexico and in the weekly radar. That movement reinforces the idea that Latin American incidents cannot be analyzed as isolated events. They are part of campaigns that cross countries and sectors quickly.

The fifth signal is technical opacity. Many reports publish victims but do not confirm whether there was encryption, leakage, or both. For defense teams, that means absence of technical detail should not be mistaken for absence of risk. A case without a technical file can still have legal, reputational, and operational impact if the organization was named on a leak site or had to keep services running manually for hours or days.

Recommendations for security teams

First, review the real ability to operate in degraded mode. The Paraguayan case shows that a return to paper is not a metaphor, but an operational necessity when systems fail. Security teams should verify which critical processes can keep running without core applications, how long that mode can be sustained, and what minimum data must remain available to maintain continuity.

Second, prioritize exposure of identities and remote services. The comparative and contextual material points to compromised credentials, exposed RDP, VPN, and RDWeb, along with the growth of phishing. Defense cannot depend only on EDR or perimeter controls. It requires phishing-resistant MFA, an inventory of remote access, privilege segmentation, and frequent review of orphaned or oversized accounts.

Third, treat leak sites as an operational phase of the incident, not as a simple press publication. When a group names an organization, it is already trying to shift its negotiating position. Teams need a specific playbook for the moment the victim appears listed, even if there is still no evidence that data has been published. That includes legal coordination, communications, forensic retention, and an early decision on whether to notify third parties.

Fourth, strengthen separation between IT, OT, and clinical or financial systems where applicable. Although the ITware Latam material shows improved segmentation in industrial environments, a significant share of organizations still report intrusion across both layers. In health care, finance, and mixed infrastructure, segmentation cannot be only logical. It must include containment testing, emergency paths, and privileged account control.

Fifth, improve protection for sensitive data that attackers can use for extortion without encryption. The impulse-store.com case and the mention of Coemi Imóveis show that pressure through data leakage remains profitable. That calls for information classification, encryption at rest and in transit, exfiltration monitoring, and controls over document repositories, ERP, CRM, and shared folders.

Sixth, incorporate intelligence on groups and leak sites into routine monitoring. Watching classic IOCs is not enough. In June, much of the useful signal came from victim names, claiming groups, and shifts in the narrative on extortion sites. Visibility into those spaces makes it possible to anticipate reputational pressure and prepare a response before the incident escalates publicly.

Seventh, review the third-party chain. The month’s material shows a region where the attack surface crosses sectors and vendors. Private medical organizations, industries, retailers, and public entities appear in the same risk map. That requires asking third parties for minimum backup, segmentation, and notification controls, and not blindly outsourcing continuity to software or infrastructure providers.

Material limits

This report covers only the material provided for June 2026 and uses, as its volume, only the facts dated within that period. Facts from earlier months that appear in the file were used only as a comparative frame of reference, always with their month explicitly stated in the text, and are not included in the monthly counts. The declared time window for the indicators is 86 facts dated in June 2026 and 7 facts from earlier months as contextual reference, not as volume.

A zero indicator, particularly for critical CVEs, means none were recorded in the material analyzed, not that exploited vulnerabilities did not exist in the region. The same applies to any absence of victims or sectors in the country section, it reflects only what appeared in the available corpus, not the full scope of the regional phenomenon. In particular, ransomware classification remains incomplete in many cases because the material reports victim names or group names, but does not always confirm encryption, exfiltration, or only a mention on a leak site.

Aggregate telemetry figures, attempts, blocks, scans, and weekly vendor averages were also left out of the counts. Those data points provide context, but they are not incidents with confirmed impact. When they are mentioned in this report, it is stated explicitly that they are attempts or automated blocks, not verified intrusions. Likewise, consumer networks and sponsored posts that are not included in the list of available sources for citation were excluded from the evidence.

Finally, regional coverage is heavily uneven across countries. Brazil and Mexico account for most of the verifiable operational mentions, Paraguay provides the clearest case of functional impact, and Colombia contributes mainly context on pressure and exposure. That means the month should be read as a signal of elevated risk, but also as a partial snapshot shaped by the quality and granularity of the available sources.