Telecom and ISP Threats in LATAM, Aug 2026

Active Threats and Campaigns

The month’s picture shows three major threat families, ransomware and extortion, espionage, and availability disruption. In Latin American telecom and ISP environments, none appeared in pure form. The campaigns were mixed with leak site claims, ongoing investigations, and connectivity failures with no closed attribution.

Ransomware and Extortion

The month closed with 17 cases where ransomware or extortion was the primary focus, but the internal taxonomy is fragmented and distinct impacts should not be merged. There was one case with confirmed encryption, Colombia’s Ministry of Justice. There was another with exfiltration without encryption, also in Colombia, where the official statement said no evidence of theft had been found at the time of the information cutoff, although an independent monitoring source acknowledged file encryption. And there were several leak site claims, where the verifiable impact did not go beyond the public mention of the victim.

That last category includes Grupo Rái and Intranet Gov Brasil, plus another eleven cases whose classification could not be determined from the available material. For security practice, that means extortion risk remains high, but the most useful data point is not the broad label, it is the level of evidence for encryption, leakage, or simple publication. A leak site does not automatically mean unavailability, and unavailability alone does not prove exfiltration.

The main operational signal is that ransomware remained a cross-cutting threat, but with very uneven impacts. In telecom and connectivity, that requires differentiated response plans. If there is encryption, the priority is recovery and forensic preservation. If there is exfiltration, the priority is legal containment, notification, and monitoring for later abuse. If there is only a leak site mention, the priority is validation, persistence hunting, and preventing reputational escalation.

Fraud and Phishing

The month’s material recorded just one documented case of fraud or phishing, and it does not belong to the core telecom and ISP vertical, but to the broader regional environment. That low presence should not be read as a lack of fraud pressure on operators. It more likely suggests that, in August, the public narrative was dominated by intrusion, extortion, and availability, not impersonation campaigns.

From an operational standpoint, that does not reduce the risk around identity abuse, SIM swap, or support fraud. It simply shows that the material analyzed did not present enough volume to turn it into a central trend in the report. As a priority signal, telecom teams should keep protecting support channels, credential reset flows, user portals, and authentication workflows, even if the period’s evidence was concentrated elsewhere.

APT and Cyberespionage

The most sensitive APT front was in Chile. The association of Lilac Typhoon with cyberespionage activity in Entel, Movistar, and Telmex networks, along with the reference to ShadowPad and the need for forensic analysis and remote access hardening, points to a campaign closer to persistence than to a visible strike. The sources do not confirm mass exfiltration, but they do describe a pattern consistent with espionage infrastructure.

The strategic relevance of that signal is high because a carrier concentrates metadata, routing information, technical inventory, and potential visibility into third-party services. If an actor manages to move inside that environment, the value of the access goes far beyond file theft. It can enable communications tracking, pivoting to providers, observation of remote administration, and preparation for future actions. For that reason, the Chile case should be read through both network resilience and national security lenses.

Critical vulnerabilities

No critical CVEs were recorded in the August 2026 material reviewed. That does not mean the region was free of critical vulnerabilities, only that the coverage reviewed did not provide explicit CVE identifiers for this period. As a result, the month’s technical focus was more on campaigns, disruptions, and claims than on documented exploitation of specific flaws by number.

Regulation and Compliance

August brought five documented regulatory moves, and all of them point in one way or another to pressure on continuity, investigations, or interagency coordination. They do not form a single regulatory agenda, but they do show telecom, connectivity, and digital services moving closer to the state response.

In Colombia, the CRC framed the interruption risk for 57,000 fixed internet users tied to small ISPs in a contractual dispute between TV Azteca and ATP. The regulatory issue here is not a sanction or a formal cybersecurity proceeding, but an institutional acknowledgment that a commercial dependency can turn a retail access network into a mass service problem. That puts supplier concentration and contractual resilience under scrutiny.

Also in Colombia, the Attorney General's Office stepped in over electric infrastructure security in Tolima after an attack, although without attributing it to cyberattacks. The case is not telecom in the strict sense, but it matters for the sector because connectivity services depend on power, backbone networks, and the physical environment. When the state adds this kind of alert to its radar, the message for carriers and ISPs is that resilience no longer stops at the logical perimeter.

The third regulatory front was the institutional response to the ransomware attack on Colombia's Ministry of Justice. Coordination with COLCERT, MinTIC, Microsoft’s DART team, and IDB partners showed a broader response model than that of a stand-alone unit. For connectivity operators and security teams, that suggests rising expectations for cooperation among the public sector, response teams, and technology vendors in high-impact incidents.

Countries and most affected subsegments

The geographic distribution in August was uneven. Some countries saw multiple events of different kinds, while others had one or two tightly concentrated incidents. Overall, Colombia, Chile, Brazil and Mexico stood out as the most visible nodes in the month’s telecom and connectivity provider signal.

Colombia

Colombia had the highest visible operational density in the month. The ransomware attack on the Ministry of Justice, the high alert from ColCERT, the BGP disruption, the major Movistar outage, and the CRC warning about interruption risk for small ISPs all converged there. That accumulation shows that the country not only suffered incidents, but also saw broad regulatory and media attention on continuity and resilience.

The most exposed subsegment was retail connectivity and public digital services dependent on network infrastructure. No single campaign against telecom was observed, but there were multiple signs of fragility at different layers. For an operator or internet provider, that suggests readiness should include links, fiber, BGP, ransomware response in support systems, and management of contractual dependence on wholesalers.

Chile

Chile was the center of the telecommunications espionage front. The Entel, Movistar and Telmex case, with a judicial investigation and technical references to ShadowPad, made it one of the month’s most sensitive stories. The country’s relevance in the report is not tied to a service outage, but to the potential depth of access and the institutional impact of the alert.

The most affected subsegment was large phone and internet carriers. The sources did not confirm a data breach, but they made clear that the actor’s interest may have been in the network and its persistence mechanisms. For Chile, August showed that the telecom attack surface can become a target for foreign intelligence and that reputational damage begins before any public leak.

Brazil

Brazil combined two types of signal. One was an attack or claim involving Grupo Rái, a company linked to the communications sector. The other was the highest volume of cyberattacks against the telecommunications sector in the telemetry cited by local media, with 2,927 attacks in the period analyzed by Check Point, a figure that should be read as telemetry, not confirmed incidents.

The subsegment here is twofold, communications companies and cybersecurity services for corporate customers offered by operators. Vivo’s launch of the new Agêntico SOC for corporate clients is not an incident, but it does show how carriers are expanding into managed defense services. That commercial move reflects real market demand, but it should not be confused with a monthly risk measure.

Mexico

Mexico was dominated by availability incidents. The outages affecting gob.mx, the failures at multiple ISPs and the Telmex case involving cable theft point to an ecosystem where last-mile connectivity and physical infrastructure remain weak points. The material did not contain a confirmed cyberattack against a Mexican carrier with the same relevance as the Chilean or Colombian cases.

The most visible subsegment was end users and online public services dependent on third-party connectivity. That leaves a useful signal for the sector, operational resilience for portals and digital services should be designed with the assumption that the network layer can also fail for reasons outside the system itself. For telecom companies and ISPs, that means reviewing redundancy, link monitoring and commercial response times.

Trends and signals to watch

The comparison with the previous month shows a sharp jump in verified incidents, from 67 to 122. Unclassified incidents also rose sharply, from 17 to 45. That suggests August saw more activity, but also more noise or more material that sources have not yet closed out. That combination deserves attention, because more incidents do not always mean more clarity. Sometimes they mean more exposure without a final attribution.

The increase in ransomware or extortion cases, from 15 to 17, is not explosive in absolute terms. It does, however, reinforce the persistence of that threat as one of the main risks for the vertical. What changed is the variety of how it appeared. In August there was confirmed encryption, unresolved exfiltration, and several mentions on leak sites. That fragmentation makes tactical reading harder, but it reflects more accurately how extortion campaigns operate today.

The regulatory movement, which went from 0 to 5, is perhaps the most underestimated signal of the month. When regulators, ministries, and oversight bodies begin to intervene on continuity, outage risk, or response coordination, the effect on telecoms and ISPs goes beyond the individual incident. Expectations rise for traceability, notification, and technical support before the public.

It is also worth looking at the gap between the dominant threat and total volume. In July, the picture was already unclassified, but on a smaller base. In August, unclassified reached 47 of 122 incidents. That suggests that journalists and monitoring sources are still tracking many events where the impact is clear but the classification is not yet closed. For security teams, the practical signal is straightforward, do not wait for the perfect label to begin containment, investigation, and documentation.

Security recommendations for telecom and ISP teams

Telecom and ISP teams in Latin America should treat August as a stress test, not as an isolated anomaly. The mix of espionage, ransomware, physical disruption and contractual risk means security has to be layered, not limited to detection tools.

First, review remote access and persistence in network environments. The Chile case points to espionage infrastructure with possible ShadowPad use and long-term presence. That requires an inventory of remotely managed systems, a review of edge configurations, credential rotation, MFA validation where applicable, and auditing of lateral movement across corporate and operational networks.

Second, clearly separate operational continuity from forensic classification. When connectivity drops, as in Mexico or in Movistar's outage in Colombia, the team must quickly determine whether the event is physical, backbone-related, routing-related, or a cybersecurity incident. That distinction is not cosmetic, it affects internal escalation, customer communications, and any eventual notification obligation.

Third, harden ransomware response with different playbooks depending on impact. If encryption is involved, the priority is controlled restoration and evidence preservation. If there is a leak-site claim, as in the Brazilian cases, the priority is validation, log review, and monitoring for possible later postings. If there is only extortion with no confirmed encryption, legal and reputational pressure may be the first line of damage.

Fourth, map dependencies on third parties and wholesalers. The CRC Colombia warning about 245 small ISPs potentially affected by a contractual dispute shows that concentration risk does not always come from a malicious actor. Before the problem escalates into a visible outage, it is worth reviewing SLAs, capacity dependencies, backup routes, and communication channels with upstream providers.

Fifth, add monitoring for critical physical infrastructure. Cable theft in Mexico and fiber damage in Colombia are reminders that security in this sector includes physical spans, splices, cable runs and power. For large and small operators alike, that means stronger field monitoring, asset inventory, contractor coordination, and rapid response to last-mile cuts.

Frequently Asked Questions

What type of threat dominated the month across telecom, ISPs, and linked digital services?

The strongest signal was mixed, with ransomware, espionage, and connectivity disruptions all unfolding in the region. Colombia accounted for the confirmed ransomware cases and several continuity incidents, Chile concentrated the cyberespionage front targeting carriers, and Mexico contributed service outages and connectivity failures. The Relevant Incidents section orders those cases by country.

Was there solid evidence of a confirmed mass breach in Chilean carriers?

There was no confirmed mass breach in the material reviewed. The sources on Entel, Movistar and Telmex refer to an investigation into possible cyberespionage, with suspicion of ShadowPad and prolonged access, but no verified list of stolen data and no official confirmation of exfiltration. The Relevant Incidents and Active Threats and Campaigns sections spell out that distinction.

Which ransomware cases had truly verifiable impact?

The strongest case was Colombia's Ministry of Justice, where the agency itself confirmed encryption of part of its infrastructure and degraded services. In Brazil, there were ransomware claims involving Grupo Rái and Intranet Gov Brasil, but the material did not allow the real scope to be closed. The Active Threats and Campaigns section distinguishes encryption, exfiltration, and a leak site.

What should worry a small ISP in the region most after this month?

Third-party dependence and last-mile fragility. The warning from Colombia's CRC showed that a contractual dispute can put tens of thousands of small-provider users at risk, without any cyberattack. On top of that came physical fiber cuts, as in Colombia and Mexico. The Countries and Most Affected Subsegments section cross-references both angles.

Were any critical CVEs exploited in August 2026 for this vertical?

No. The material reviewed did not mention critical CVEs for telecommunications or connectivity providers in August 2026. That does not mean no vulnerabilities were exploited in the region, only that none appeared with a CVE identifier in the sources reviewed. The Critical Vulnerabilities section makes that point explicit.

Material limitations

This report was prepared exclusively from the material provided for August 2026 and from five facts from earlier months used only as comparative context, never as part of the period volume. The time window for the indicators is the one stated at the start, and the basis for all indicators is 122 verified facts from the period.

A 0 indicator, especially for critical CVEs, means it did not appear in the analyzed material, not that there were no critical vulnerabilities in the region. The same applies to any missing mention, the absence of data should not be read as the absence of a fact. In a month with so much incomplete classification, that caution is necessary to avoid overstating the risk.

Promotional sources, commercial press releases, consumer social media posts, and material that was not part of the authorized source list were also excluded from trend construction. Check Point's aggregated telemetry, while useful as exposure context, was not added to the incident volume because it reflects automated attempts or blocks, not intrusions with confirmed impact.

Finally, several facts remained only partially confirmed or without a closed public attribution, especially in leak site cases, connectivity outages, and ransomware claims. When the material does not allow a decision between encryption, exfiltration, or a mere mention on the actor's portal, the report preserves that uncertainty instead of forcing a classification.