Latin America Ransomware Activity, Aug. 2026

Active Threats and Campaigns

August showed a ransomware and extortion ecosystem dominated by multi-target campaigns, with a strong presence of leak sites and a subset of incidents in which the material does allow a distinction between encryption, exfiltration, or simple victim publication.

Ransomware and extortion with confirmed or probable impact

Qilin was the most visible actor in Argentina during the month, with Sanatorio Modelo de Caseros, INMAC Ingeniería y Arquitectura, and the Tecno Acción case in the incident tracking environment. In Sanatorio Modelo de Caseros, there are signs of encryption and operational disruption in one source, but other sources are limited to the leak site claim and the unconfirmed breach category. That contrast is typical of August, the material confirms extortion pressure before the full technical detail.

DragonForce led a regional campaign that left Criba as a victim in Argentina and another publication in Brazil. In Criba, there is a specific estimate of leaked data, which moves the case from a mere mention to exfiltration with publication pressure. The group also appears as one of the actors maintaining a sustained presence in South America, according to the analysis cited by Security Arsenal.

The Gentlemen remained active across several countries and verticals, with a strong presence in manufacturing, construction, professional services, healthcare, and transportation. In the region, its relevance is not limited to the month’s victims. The comparative framework places it among the most prolific actors in South America in the first half of 2026, and the technical material on its attack chain describes abuse of exposed perimeters, network reconnaissance, and EDR evasion.

CoinbaseCartel, BLACKWATER, and Kazu round out the picture with victims in transportation, insurance, healthcare, and professional services. Not every case allows for a confirmation of encryption. In several, the real signal is publication on a leak site and the threat of disclosure. In others, there are descriptions of stolen data or quantified leakage. That mix confirms that extortion value no longer depends only on locking systems, but on making a credible claim visible.

Documented fraud and phishing

The 25 documented fraud or phishing incidents in the period confirm that malicious activity was not limited to ransomware. The available material does not concentrate these events in a single regional campaign, but it does present them as part of the same risk climate, with deception, initial access, and credential abuse techniques that can later feed an extortion incident.

For defensive teams, this category matters because it is often the step before intrusion. The month repeatedly shows chains that begin with remote access, firewall exposure, or compromised credentials. Although the report separates fraud and phishing from ransomware, the coexistence of both axes in the same period suggests a shared and reusable entry surface.

APT and hacktivism

The August material does not show a clear block of APT or hacktivism with confirmed Latin American victims within the scope of this report. There are external references to campaigns and alerts in other contexts, but they are not enough to classify a regional trend for this period under that axis. The verifiable focus of the month remains ransomware and extortion.

Critical vulnerabilities

The material from the period mentions 16 critical CVEs, but it does not allow for a complete list of confirmed exploitation against Latin American victims with the same level of detail for every case. The presence of CVEs in the source does not, by itself, prove attribution or successful impact in the region.

The most useful signal here is the perimeter attack surface. The material repeatedly points to abuse of VPNs, firewalls and remote access, and The Gentlemen appears tied to a specific CVE in Check Point. That does not mean every case in the month can be explained by the same vector, but it does show that perimeter exposure remains an especially profitable entry point for RaaS crews.

Regulation and compliance

August saw few strict regulatory moves in the verified material, but compliance impact was not absent. Only one documented regulatory action appeared in August, compared with three in the prior month, pointing to a quieter agenda on rules or formal notices and a greater weight on operational incidents.

The Oldelval case is the clearest example in this chapter, because it included a filing with the CNV and company reporting on the incident, the scope of the impact on administrative systems, and the continuity of crude transport. That kind of notification matters for both compliance and crisis management, since it establishes an early corporate account and leaves less room for speculation.

In the health sector, the material also points to compliance tension, though not always through formal regulatory statements. Sanatorio Modelo de Caseros and Instituto Ferrero de Neurología y Sueño appear in the context of leak sites and breach trackers. When public confirmations do not arrive, regulatory pressure often shifts to internal audits, notification obligations, and reviews of third-party contracts.

Countries Most Affected in Latin America

The month’s geographic distribution shows concentration in Argentina and Brazil, with Mexico, Chile, Peru, and Colombia included as part of the comparative context and the regional victim coverage, although this report only weighs facts dated in August 2026.

Argentina

Argentina recorded the highest density of verifiable incidents during the period. The list includes Criba, Flecha Bus, AMCA, Sanatorio Modelo de Caseros, Tecno Acción, INMAC Ingeniería y Arquitectura, Oldelval, and Instituto Ferrero de Neurología y Sueño, spanning sectors from construction and transportation to health care, insurance, and energy.

The key takeaway in Argentina is not just volume, but variety. The country concentrated victims claimed by Qilin, DragonForce, CoinbaseCartel, BLACKWATER, Kazu, and, incidentally, references to The Gentlemen and INC RANSOM in Oldelval’s environment. That mix of actors suggests there is no single entry point or one vulnerable sector.

There is also a pattern of uneven transparency. Oldelval offered a clearer corporate account than other cases, while leak site posts and breach trackers dominate the reporting for Sanatorio Modelo de Caseros and Criba. For local teams, that means combining reputation monitoring, perimeter hardening, and response protocols that do not depend on a third party confirming the incident.

Brazil

Brazil appears mainly as the regional counterpart to campaigns that also affected Argentina. The Gentlemen and DragonForce concentrated posts in South America, and the month’s material confirms victims in Brazil within the same analyzed windows. In addition, the semester’s comparative coverage still places it among the region’s most exposed countries.

Brazil’s relevance in August is not limited to the number of events. What matters is that it appears as a jurisdiction with enough density of actors, leak sites, and published victims to support ongoing campaigns. In practice, that makes the country a major barometer for regional ransomware activity.

Mexico

Mexico does not concentrate dated facts within the main incident block for the period at the same level as Argentina, but the available material keeps it among the countries with broad historical exposure. For August, the comparative context still shows a heavily targeted market, with the public sector, health care, manufacturing, and business services among the recurring targets.

The useful reading for the month is that Mexico’s attack surface remains broad, although many undated historical records were left out of the indicators. That prevents historical volume from being mixed with monthly volume. Even so, Mexico’s ecosystem remains a regional reference point for ransomware monitoring because of the number of victims publicly claimed in tracking sources.

Chile

Chile appears as a reference country for the expansion of Qilin and The Gentlemen in the comparative frame, and as a territory where other groups also maintained activity in previous months. In August, the material does not show a block of dated incidents as large as Argentina’s, but it does confirm that the threat remains spread across technology, energy, and health care.

Chile’s significance lies in the type of targets, not in a single count. When ransomware actors manage to surface in sensitive or high-value verticals, the country becomes a point of interest for regional campaigns. That means looking not only at visible volume, but also at the persistence of the same groups across different jurisdictions.

Peru

Peru appears in the comparative material and in some events from nearby months, especially through monitoring of health care and the public sector. In August, the report does not record a density of dated facts comparable to Argentina’s, but it does confirm that the Andean region remains under pressure from extortion actors.

Peru’s analytical value this month is as a reminder that groups extend campaigns across countries and sectors. Although the bulk of verifiable activity is concentrated in Argentina and Brazil, the regional pattern does not leave Peru or its most sensitive verticals out.

Colombia

Colombia appears in the file as a country of concern due to incidents in the justice system and public services, although much of that material corresponds to previous weeks or comparative coverage. For August, the underlying message is that the public sector remains a viable target and that administrative disruption incidents retain political and operational relevance.

Other countries in the region

Paraguay and Bolivia do not show enough verified incidents in the August material to warrant a separate section. The rest of Latin American countries also do not present, in this set, a specific signal above the level of isolated mention. That does not mean there is no activity, only that there is no verifiable material within the scope of this report.

Trends and signals to watch

The main trend in August is the rise in visible extortion pressure, not necessarily a linear increase in all technical impacts. Compared with the previous month, verified incidents rose from 241 to 537, cases with ransomware or extortion as the primary focus went from 162 to 281, and fraud or phishing incidents increased from 7 to 25. The change is not only quantitative, it also reflects denser documentation.

The other major takeaway is sector diversification. The previous month already showed eight sectors with at least one documented incident, and August keeps that number unchanged. Far from signaling stagnation, that points to a troubling consistency. There is no single dominant vertical, but rather sustained spread across construction, health care, transportation, manufacturing, professional services, insurance, energy, and public administration.

The third signal is technical. The jump from 1 to 16 critical CVEs mentioned shows that August’s material includes more references to vulnerability exploitation and perimeter abuse. The Gentlemen, in particular, reappears tied to VPN gateways, firewalls, remote tools, and CVE-2026-50751. That combination suggests that perimeter hardening remains a high-return line of defense.

The shift in the ratio between claims and confirmations is also worth watching. Although 85% of the incidents have direct source confirmation, much of the technical damage still sits somewhere between the leak site and independent verification. For defensive intelligence, that requires three parallel layers of work: monitoring publications, institutional verification, and assessment of the likely operational impact.

Security team recommendations

The first step is to immediately harden any exposed VPN, firewall, or remote access. This month’s material and the technical analysis of The Gentlemen both point to exposed perimeter systems as a profitable intrusion path. Strong authentication, a review of exposed rules, an inventory of remote services, and accelerated patching should be at the top of the work queue.

The second priority is to improve the ability to detect early exfiltration. Several cases this month rest on leak site claims or partial leaks. That requires monitoring for unusual movement to storage services, file-sharing domains, and uncommon external accounts, along with alerts on large outbound volumes from administrative servers and privileged user workstations.

The third is to strengthen the response to compromised credentials. According to the material, The Gentlemen abuses network reconnaissance, privilege escalation, and tools designed to neutralize endpoint defenses. A useful response plan should include mass credential resets, token invalidation, service account reviews, and verification of persistent administrative access.

The fourth measure is to separate operational continuity from administrative availability. Oldelval showed that an incident can leave the main physical process untouched and still affect critical administrative systems. Energy, health care, logistics, and transportation organizations should have manual and contingency procedures for billing, shifts, dispatch, traceability, and internal coordination.

The fifth is to formalize monitoring of leak sites and breach trackers. In August, several cases only became visible because a group posted them or an aggregator indexed them. That does not replace internal detection, but it does buy time. It is advisable to establish triage processes with clear thresholds to distinguish a claim, a leak, exfiltration, and confirmed encryption.

What should a CISO prioritize this week?

Perimeter, credentials, and exfiltration monitoring should be the top priorities, because those three fronts appear repeatedly behind this month’s campaigns. If the organization has remote exposure, it should review patches and authentication. If it depends on operational continuity, it should test manual contingencies. If it has already been named on a leak site, the response needs to move from observation to containment.

How can an organization reduce the risk of being listed only as a leak site claim?

The key is to detect the attack before the threat actor publishes. That means segmenting access, limiting privileges, reviewing third-party accounts, alerting on anomalous data خروج, and keeping the inventory of exposed assets up to date. Once publication has already happened, the focus should shift to forensic verification, evidence preservation, and coordinated internal communication.

Frequently Asked Questions

What was the practical difference this month between confirmed encryption, exfiltration, and a leak site?

The difference was central to interpreting August. There were 26 cases with confirmed encryption, 22 with exfiltration without encryption, 46 mentioned only on a leak site, and 187 that the material did not allow to classify. For more detail, see the period indicators and relevant incidents sections.

Which actors stood out most this month in Latin America?

The most visible groups were Qilin, The Gentlemen, DragonForce, CoinbaseCartel, BLACKWATER, and Kazu. The signal comes not from a single source, but from cross-checking relevant incidents, threats and active campaigns, and the most affected countries in Latin America, where victims appear in Argentina, Brazil, and elsewhere.

Which sectors were most exposed in the region?

Health care, construction, transportation, manufacturing, professional services, insurance, and energy appear repeatedly in the August sample. That reading comes from cross-checking incidents by country with the ransomware cases and the indicators table, which shows eight sectors with at least one documented event.

Were critical vulnerabilities clearly exploited in the region?

The material mentions 16 critical CVEs, but it only explicitly links CVE-2026-50751 to a campaign, in the case of The Gentlemen. For the rest, the month’s evidence points more to perimeter exposure and abuse of remote access than to closed, confirmed exploitation of a complete CVE list.

How reliable is the month’s volume for measuring the real damage?

It is useful for measuring signal, not total damage. The report works with 537 verified events in August and excludes 14 without a confirmed date, and it does not add aggregated telemetry to the incidents. The material limitations section explains why a zero count or a leak site claim does not mean there was no real activity.

Material limitations

This report was built exclusively from the material provided and is geographically limited to Latin America. The time window used for the indicators was the one stated in the input, with 541 dated events in August 2026, 61 from earlier months used as a comparative frame, and 14 with unconfirmed dates excluded from the indicators.

A zero value in an indicator, especially for CVEs, means it was not recorded in the material analyzed, not that no critical vulnerabilities were exploited in the region. Likewise, a mention in a leak site does not always mean confirmed encryption or exfiltration. When the material did not allow a distinction, the category remained undeterminable.

Aggregated telemetry figures were also left out of the volume because they refer to attempts, blocks or vendor averages, not to incidents with confirmed impact. The same applies to events with unconfirmed dates, which may serve as qualitative context but do not count toward the month’s indicators or August totals.

Sources not included in the approved list were also excluded, along with consumer social media posts when they were not expressly validated within the available source, and commercial statements or promotional material used only as contextual support in some cases. The result is a useful operational snapshot, but one that is necessarily partial relative to the full ransomware universe in the region.