Threat timeline 2025–2026: the events Latin American defenders should know

This is a retrospective. We compiled it on 20 October 2026, looking back over the 22 months since January 2025, to give defenders in Latin America a single sourced reference for the events that shaped their risk. Every date below is the date of the event or of its first public disclosure by the primary source, not the date we wrote about it. Nothing here was published by us at the time.

How we built it

• Selection. Events that changed what a security team in Latin America should check, patch or plan for: regional campaigns and regulation, plus global incidents that hit software the region runs everywhere. It is not a ranking and not a count of how often anything happened.
• Sources. Each entry links to a primary source (the vendor, the researcher, the regulator, CISA or the affected organization) that our editors opened on 20 October 2026. Every entry is [Confirmed] at that level; we dropped candidates that only had press coverage.
• Our view. The "Why it matters" lines are [Our assessment]. They say what we would do, not what the source says.
• Gaps. There is no entry for Chile, Argentina or Mexican government incidents. That does not mean nothing happened. It means we could not open a primary source for it today, and we would rather leave a gap than fill it from memory. We will add entries as we verify them.

2025

8 January 2025 · Ivanti Connect Secure zero-day (CVE-2025-0282). Mandiant disclosed exploitation of an unauthenticated remote code execution flaw in Ivanti Connect Secure VPN appliances since mid-December 2024, attributing it to UNC5221, which it describes as "a suspected China-nexus espionage actor". CISA added it to KEV the same day.
Why it matters: Mandiant documented malware that tampers with the appliance's upgrade process, so a patched appliance is not proof of a clean one. Hunt for implants on any edge VPN that was exposed.
Source: Mandiant, Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation, 8 January 2025.

10 March 2025 · Blind Eagle against Colombian justice and government. Check Point Research linked campaigns using malicious .url files against Colombian judicial and government entities since November 2024 to Blind Eagle (APT-C-36), and said one December 2024 campaign reached "more than 1,600 victims". The group reused a technique related to CVE-2024-43451 within days of Microsoft's patch.
Why it matters: a regional actor adopting a fresh technique within a week. Colombian public bodies should block .url and WebDAV lures delivered through file-sharing links.
Source: Check Point Research, Blind Eagle: …And Justice for All, 10 March 2025.

18 March 2025 · tj-actions/changed-files supply-chain compromise (CVE-2025-30066). CISA warned that a compromised GitHub Action exposed CI secrets in workflow logs between 12 and 15 March 2025, possibly enabled by a compromise of reviewdog/action-setup (CVE-2025-30154). Both are in KEV.
Why it matters: any team that ran the action in that window should rotate the secrets it could see, and pin third-party actions to full commit SHAs.
Source: CISA, Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154), 18 March 2025.

31 March 2025 · Peru's new data-protection regulation takes effect. The regulation of Peru's Personal Data Protection Law (Supreme Decree 016-2024-JUS) came into force 120 days after its publication. Article 34 requires the controller to notify the national authority within 48 hours of becoming aware of a security incident that exposes large volumes of data, affects many people, involves sensitive data or causes evident harm.
Why it matters: Peruvian incident-response plans and supplier contracts now need a 48-hour regulator clock for serious incidents, and someone who decides quickly whether an incident meets that bar.
Sources: MINJUSDH, announcement of the new regulation, 31 March 2025; text of D.S. 016-2024-JUS, published 30 November 2024.

4 April 2025 · RENIEC denies a breach and blames misuse of access. Peru's national identity registry said it had not been hacked, attributed the reported exposure of citizen data to misuse by a user at the Ministry of the Interior, filed a complaint and suspended that ministry's access, along with the labor ministry's.
Why it matters: if RENIEC's account is right, the data left through an authorized consumer, not the registry's perimeter. Organizations that query identity services need per-user access, monitoring and least privilege on those integrations.
Source: RENIEC, Reniec desmiente hackeo y denuncia al Ministerio del Interior por uso indebido de datos, 4 April 2025.

24 April 2025 · SAP NetWeaver zero-day (CVE-2025-31324). SAP released an emergency note for an actively exploited, unauthenticated file-upload flaw in NetWeaver Visual Composer, rated CVSS 10.0. A related flaw, CVE-2025-42999, followed. Both are in KEV.
Why it matters: SAP runs core finance at many large companies in the region. Check internet-facing NetWeaver Java systems for webshells, not only for the patch.
Source: Onapsis, SAP NetWeaver Flaw Lets Threat Actors Take Full Control: CVE-2025-31324 and CVE-2025-42999 Explained, 13 May 2025 (date of the SAP note per Onapsis's timeline).

21 May 2025 · Lumma Stealer disruption. Microsoft's Digital Crimes Unit, with the US Department of Justice, Europol and Japan's JC3, took action against about 2,300 domains of the Lumma infostealer, after identifying "over 394,000 Windows computers globally infected" in two months. Microsoft gives no regional breakdown.
Why it matters: infostealer logs are how stolen sessions and passwords reach access brokers. Check whether corporate single sign-on credentials appear in stealer logs and revoke sessions, not only passwords.
Source: Microsoft, Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool, 21 May 2025.

3 July 2025 · Brazil's central bank partially lifts a PIX provider's suspension. Banco Central do Brasil replaced its precautionary suspension of C&M, a technology provider serving PIX participants, with a partial one after the company adopted measures to reduce the chance of new incidents. C&M may only operate on business days, from 6:30 to 18:30, with the express consent of each participating institution and with strengthened fraud monitoring and transaction limits.
Why it matters: one provider's incident constrained many institutions at once. Third-party access to payment rails is part of your attack surface.
Source: Banco Central do Brasil, A suspensão cautelar da C&M foi substituída por uma suspensão parcial, 3 July 2025.

22 July 2025 · SharePoint "ToolShell" exploitation (CVE-2025-53770). Microsoft attributed exploitation of on-premises SharePoint servers, seen "as early as July 7, 2025", to Linen Typhoon, Violet Typhoon and Storm-2603, and later reported Storm-2603 deploying Warlock ransomware. CISA had added CVE-2025-53770 to KEV on 20 July.
Why it matters: on-premises SharePoint is common in public administration across the region. Microsoft's guidance was to patch and also rotate ASP.NET machine keys and restart IIS; a patch alone leaves stolen keys usable.
Source: Microsoft, Disrupting active exploitation of on-premises SharePoint vulnerabilities, 22 July 2025.

22 July 2025 · Coyote banking trojan abuses Windows UI Automation. Akamai documented Coyote, which targets Brazilian users, as the first malware seen in the wild abusing Microsoft UI Automation to identify banking and cryptocurrency sites.
Why it matters: the technique sidesteps simple window-title checks. Endpoint teams should treat unexpected processes calling UI Automation as a signal worth reviewing.
Source: Akamai, Coyote in the Wild: First-Ever Malware That Abuses UI Automation, 22 July 2025.

15 August 2025 · Peru publishes a draft national cybersecurity strategy. The Presidency of the Council of Ministers published the draft Estrategia Nacional de Ciberseguridad 2026–2028 (ESNACIB) for comment.
Why it matters: operators of critical infrastructure in Peru can align their roadmaps now, before the strategy turns into specific obligations.
Source: PCM, Propuesta de la Estrategia Nacional de Ciberseguridad del Perú 2026-2028 (ESNACIB), 15 August 2025.

26 August 2025 · Salesloft Drift OAuth tokens used to raid Salesforce. Google Threat Intelligence warned that UNC6395 used compromised Drift OAuth tokens to export data from Salesforce instances between 8 and at least 18 August 2025, mainly to harvest credentials stored in records.
Why it matters: SaaS-to-SaaS integrations bypass your MFA. Inventory OAuth grants and search CRM records for keys and passwords pasted into support cases.
Source: Google Threat Intelligence Group, Widespread Data Theft Targets Salesforce Instances via Salesloft Drift, 26 August 2025.

5 September 2025 · Brazil tightens rules after attacks on payment institutions. Citing organized crime behind "recentes eventos de ataques a instituições financeiras e de pagamentos", Banco Central do Brasil capped TED and PIX transfers at R$15,000 for institutions connected through technology providers (PSTIs) or operating without authorization, and tightened PSTI accreditation.
Why it matters: in Brazil, a provider's information-security controls are now part of whether its clients can move money at full limits.
Source: Banco Central do Brasil, BC aprova medidas para reforçar a segurança do Sistema Financeiro Nacional, 5 September 2025.

23 September 2025 · Shai-Hulud worm in npm. CISA warned that a self-replicating worm had compromised more than 500 npm packages to steal GitHub tokens and cloud keys.
Why it matters: a developer laptop is a production credential store. Rotate developer and CI credentials after any exposure and enforce phishing-resistant MFA on GitHub and npm accounts, as CISA advised.
Source: CISA, Widespread Supply Chain Compromise Impacting npm Ecosystem, 23 September 2025.

3 October 2025 · Water Saci spreads through WhatsApp in Brazil. Trend Micro's research team reported SORVEPOTEL, malware that hijacks WhatsApp sessions to spread itself through ZIP attachments, with "457 of the 477 cases we detected" in Brazil. A December follow-up described new variants.
Why it matters: WhatsApp is a business channel across the region. Block execution of scripts and shortcuts from compressed attachments and watch for automated WhatsApp Web activity on corporate PCs.
Sources: TrendAI (Trend Micro), Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users, 3 October 2025; follow-up, 2 December 2025.

4 October 2025 · Oracle E-Business Suite zero-day (CVE-2025-61882). Oracle issued a security alert for a remote code execution flaw in E-Business Suite. Google Threat Intelligence reported exploitation from 9 August 2025 and an extortion campaign using the CL0P brand, without a formal attribution.
Why it matters: exploitation preceded the patch by about two months. Organizations running EBS should patch CVE-2025-61882 and CVE-2025-61884 and run the hunting steps Google published.
Sources: Oracle, Security Alert Advisory CVE-2025-61882, 4 October 2025; Google Threat Intelligence Group, Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign, 9 October 2025.

15 October 2025 · Maverick banking trojan on WhatsApp. Kaspersky described Maverick, a WhatsApp-distributed banking trojan with code overlaps with Coyote, and said it "blocked 62 thousand infection attempts" in Brazil in the first ten days of October.
Why it matters: several WhatsApp-borne banking trojans were active at once. Fraud and security teams at Brazilian banks benefit from sharing indicators across these campaigns.
Source: Kaspersky, Maverick: a new banking Trojan abusing WhatsApp in a mass-scale distribution, 15 October 2025.

3 December 2025 · React Server Components RCE (CVE-2025-55182). The React team disclosed an unauthenticated remote code execution flaw, rated CVSS 10.0, in React Server Components, affecting Next.js and other frameworks built on them. CISA added it to KEV two days later.
Why it matters: modern web front-ends are server code too. Track framework advisories with the same urgency as server software.
Source: React, Critical Security Vulnerability in React Server Components, 3 December 2025.

2026

16 March 2026 · A second Langflow RCE (CVE-2026-33017). Langflow disclosed that an endpoint for building public flows executed attacker-supplied code without authentication, a different flaw from CVE-2025-3248. CISA added it to KEV on 25 March; CVE-2025-3248 had been in KEV since 5 May 2025.
Why it matters: AI-pipeline tools are being exploited like any other web application. Keep them off the internet and patched.
Source: Langflow, GitHub Security Advisory GHSA-vwmf-pq79-vjvx, 16 March 2026.

11 May 2026 · TanStack packages poisoned with valid provenance (CVE-2026-45321). TanStack published an advisory after malicious versions of its npm packages were released. Tenable counted "84 malicious package versions" across 42 packages and tied them to the "Mini Shai-Hulud" campaign. CISA added the CVE to KEV on 27 May.
Why it matters: a valid provenance attestation did not mean a safe package. Use lockfiles, block install scripts by default and restrict network egress from CI runners.
Sources: TanStack, GitHub Security Advisory GHSA-g7cv-rxg3-hmpx, 11 May 2026; Tenable, Mini Shai-Hulud: frequently asked questions, 21 May 2026.

24 June 2026 · Microsoft's 2011 Secure Boot certificates start expiring. The KEK CA 2011 expired on 24 June, the UEFI CA 2011 on 27 June and the Windows Production PCA 2011 on 19 October 2026. Microsoft says devices keep booting, but those without the 2023 certificates stop receiving new boot-level protections.
Why it matters: older fleets in small businesses and public bodies are the most likely to be missing the 2023 certificates. Inventory them before you need a revocation to land.
Source: Microsoft, Windows Secure Boot certificate expiration and CA updates, updated 18 May 2026.

5 July 2026 · Vishing crews enroll their own passkeys in Entra ID. Okta reported that a group it tracks as O-UNC-066 (CL-CRI-1147 in Unit 42's naming, linked to the "Pink" extortion site) used phone calls and an operator-controlled phishing panel to register passkeys on victims' Microsoft Entra accounts.
Why it matters: strong authenticators are only as strong as the enrollment process. Require identity verification before a new authenticator is added and alert on new passkey registrations.
Source: Okta, Vishing actors target Microsoft Entra passkey enrollment, 5 July 2026.

14 July 2026 · Eleven forgotten UEFI shims bypass Secure Boot. ESET described 11 old, Microsoft-signed shim bootloaders that can be used to bypass Secure Boot (CVE-2026-8863 and a second ID, CVE-2026-10797, that had no public CVE record when we checked). Microsoft revoked them in the DBX update of 9 June 2026.
Why it matters: the revocation only protects machines that received it. Check DBX on every host, including Linux servers that do not get Windows Update.
Source: ESET, Forgotten UEFI shims undermining Secure Boot, 14 July 2026.

17 July 2026 · wp2shell: pre-authentication RCE in WordPress core. WordPress 7.0.2 and 6.9.5 fixed a chain of two core flaws (CVE-2026-63030 and CVE-2026-60137) that gave anonymous attackers code execution on default installs, and WordPress forced the update. Wiz reported exploitation in the wild on 20 July, and CISA added both CVEs to KEV on 21 July.
Why it matters: WordPress runs a large share of government, university and small-business sites in the region. Confirm the update landed, then check for backdoors planted before it did.
Sources: WordPress.org, WordPress 7.0.2 Release, 17 July 2026; Wiz Research, Exploitation in the Wild of wp2shell, 20 July 2026.

31 July 2026 · CaptiveCrunch: hotel Wi-Fi as a delivery channel. Microsoft described Storm-2945 manipulating hotel captive-portal traffic to deliver malware and run device-code phishing against travelers. Microsoft "assesses that Storm-2945 is an operational sub-cluster of Midnight Blizzard". A 5 October update says the activity resumed on 29 September 2026.
Why it matters: executives and staff who travel are a target. Follow Microsoft's advice: prefer a phone hotspot or eSIM over hotel Wi-Fi, and block the device-code sign-in flow where you do not need it.
Source: Microsoft, CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft, 31 July 2026, updated 5 October 2026.

3 September 2026 · Exploited MikroTik RouterOS flaws. MikroTik disclosed six RouterOS vulnerabilities and said the unauthenticated SSH command-execution flaw (CVE-2026-67279) "was seen being exploited in the wild". Fixes are in 7.24.2, 7.23.4 and 6.49.21. CISA added three of the CVEs to KEV in September.
Why it matters: MikroTik routers are everywhere at internet providers and small-business network edges in the region. Close SSH and WebFig to untrusted networks, upgrade, and look for scripts or users nobody created.
Source: MikroTik, September 2026 vulnerability, 3 September 2026.

22 September 2026 · A second exploited WordPress core flaw (CVE-2026-87902). WordPress 7.1.2 fixed an unauthenticated flaw in page-template resolution that can lead to code execution under certain server and theme conditions, with backports to every supported branch. CISA added it to KEV on 25 September.
Why it matters: two exploited pre-authentication core flaws in ten weeks. Patching WordPress needs to be measured in days, with a check for compromise afterwards.
Sources: WordPress.org, WordPress 7.1.2 Release, 22 September 2026; GHSA-7hp8-65ch-5whp.

What the pattern says

[Our assessment] Four threads run through these 22 months:

1. Patched is not clean. Ivanti, SharePoint, SAP, Oracle and WordPress all saw exploitation before or right after the fix. The follow-up work (rotating keys, hunting for implants, checking accounts) is what decides whether an organization was actually protected. That is the question a compromise assessment answers.
2. Messaging apps and banking fraud. Brazil saw several WhatsApp-borne banking trojans at the same time. The payload is local; the delivery channel is the one everybody uses for work.
3. The software supply chain is now a production risk. GitHub Actions, npm and AI-pipeline tools were exploited for the secrets they hold. Developer credentials deserve the same protection as administrator credentials.
4. Regulators are setting clocks. Peru's 48-hour notification rule for serious incidents and Brazil's controls on payment-technology providers turn security gaps into compliance deadlines.

If you want to test how your organization would handle one of these scenarios, a tabletop exercise built on a real entry from this list is a good place to start.

Corrections and additions

We will keep this page as a dated record and add entries only once we have opened a primary source. If you know of an event we missed, or a date we got wrong, write to us and include the source.