Intel471

Cyberattacks in LATAM increased from over 250 in 2024 to over 450 in 2025.

Brazil accounted for about 30% of ransomware victims in LATAM in 2025, followed by Mexico at about 14% and Argentina at about 13%.

Over 200 instances of access offers impacting 17 countries in Latin America were observed from January 2025 to December 2025.

The most targeted country by initial access brokers was Brazil with over 70 victims, followed by Mexico with over 30 and Argentina with over 20.

The most impacted industries by initial access brokers in LATAM in 2025 were national government, agriculture and food and beverage production and education.

The most common method that access brokers leveraged to obtain access to organizations in LATAM in 2025 was the abuse of compromised login credentials.

At least 119 hacktivist attacks were observed across 15 countries of Latin America in 2025.

Brazil was the most targeted country by hactivists in 2025, with 34 attacks.

Colombia was the most targeted country by DDoS attacks with over 20 victims, followed by Venezuela and Brazil, in 2025.

The most impacted industries by ransomware in LATAM were retail, wholesale and distribution; agriculture and food and beverage production; and health care providers and services.

The most targeted technology by initial access brokers in LATAM in 2025 was corporate remote access portals.

The most targeted sectors by ransomware in LATAM in descending order were consumer and industrial products; energy, resources and agriculture; and professional services and consulting.

The number of ransomware variants in LATAM rose from 48 to 79 with the most impactful gangs being the Qilin, The Gentlemen, SafePay, Akira and Inc. groups.

The most impacted sectors by initial access brokers in LATAM in 2025 in descending order were public; energy, resources and agriculture; and technology, media and telecommu- nications