White Paper

The Cyber Threat Landscape in Latin America 2024–2026

Across LATAM, Attackers Are Logging In, Not Breaking In – Here’s How to Catch Them

Drawing on Darktrace customer cases across six countries, 490,000+ phishing emails detected in six months, and targeted threat hunts, this report maps how identity-led intrusion and cloud-enabled extortion are reshaping risk across Latin America, and what defenders should prioritize.

No Details required

Download now

100+

Darktrace resources dowloaded in last 30 days

490,000+

phishing emails detected

70%

phishing passed DMARC

44%

malware spread after phishing

What's inside this resource

This is some text inside of a div block.

Infostealers, phishing, and access brokers supply reliable entry at scale, and a single infection can signal compromise well beyond the first host.

Credential theft becomes an industrialized access economy

Infostealers, phishing, and access brokers supply reliable entry at scale, and a single infection can signal compromise well beyond the first host.

Heading

This is some text inside of a div block.

A large share of activity stays unattributed – detect credential abuse, privilege escalation, and anomalous data movement before encryption.

Ransomware in LATAM is now an access and data problem

A large share of activity stays unattributed – detect credential abuse, privilege escalation, and anomalous data movement before encryption.

Heading

This is some text inside of a div block.

Darktrace threat hunters tested for the emerging AI-as-a-C2-proxy behavior, an emerging tactic that shrinks defenders’ signal-to-noise.

‍

Can attackers hide command-and-control inside the AI tools you already allow?

Darktrace threat hunters tested for the emerging AI-as-a-C2-proxy behavior, an emerging tactic that shrinks defenders’ signal-to-noise.

‍

Heading

Unlock the insights

White Paper

The Cyber Threat Landscape in Latin America 2024–2026

Digital growth is outrunning security maturity across Latin America

Latin America is moving fast. Hybrid cloud, digital payments, SaaS, and AI-enabled services are expanding the attack surface faster than visibility, skills, and regulation can keep up. Attackers have adapted. Instead of loud, exploit-first campaigns, they steal or buy credentials, abuse trusted tools, and persist quietly inside legitimate workflows, where perimeter controls and signature-based detection have little to catch.

One attack logic behind different actors

Drawing on Darktrace customer cases across Colombia, Mexico, Brazil, Chile, Ecuador, and Panama (2024–2026), plus Darktrace / EMAIL telemetry from October 2025 to March 2026, this report finds a consistent pattern behind varied payloads, sectors, and threat groups:

44% of observed cases involved non-ransomware malware spreading after initial compromise via phishing or compromised credentials
490,000+ phishing emails detected in six months. 70% passed DMARC and 48% were spear-phishing
55,000+ phishing emails reached VIP users, over 11% of all those observed
Ransomware is shifting from encryption toward data leak extortion, with BlackSuit, Sauron, Medusa, and Dire Wolf among the strains surfacing, while a large share of activity remains unattributed
Education was the most impacted sector (18% of incidents), and Colombia the most impacted country
State-aligned activity, including SnappyBee/DEEDRAT linked to Salt Typhoon in Brazil, exploits the same visibility gaps as financially motivated cybercrime

The practical challenge isn’t simply more attacks. Cybercriminals, regional operators, and state-aligned actors now rely on the same playbook: stolen credentials, trusted tools, low-noise persistence, and fast data theft.

What you’ll learn

How infostealers, phishing, and access brokers have industrialized credential access
Why ransomware in LATAM is best understood as an access and data problem, and which pre-encryption behaviors to detect
How VPN, RMM, and SaaS abuse lets attackers blend into normal operations
Country-by-country snapshots of Colombia, Chile, Mexico, Brazil, and Ecuador, each with implications for defenders
Technical appendices covering a Colombian court scam, SnappyBee/DEEDRAT, Blind Eagle TTPs, and threat hunts for Earth Alux and AI-as-C2-proxy activity
Three priorities for security leaders: reduce identity exposure, improve post-access visibility, and strengthen readiness for extortion-driven incidents