South America

(Extract of Thales’ CTI datas) < Back

> Countries List :

Brazil, Chile, Panama, Uruguay, Venezuela, Bolivarian Republic Of, Argentina, Bolivia, Colombia, Costa Rica, Cuba, Guatemala, French Guiana, Honduras, Nicaragua, Paraguay, Peru, Ecuador

Contextual analysis of CIS and Geocyber risks

17 July 1979 remains a pivotal date in the history of South American geopolitics. A military junta seized power in Managua, Nicaragua’s capital, triggering a civil war that engulfed the country. The so-called Sandinista revolution marked the start of more than 10 years of civil war in Latin America.

 

Geopolitical tensions abound in the Americas, fuelled by border conflicts between countries or social conflicts within them, as well as the dominant role of the United States.

 

Central and South America are regions beset by perennial and long-standing conflicts. In Central America, the Sandinista revolution against the US-backed dictatorship in Nicaragua in the 1970s marked the beginning of a decade of strife.

 

In South America, some tensions are rooted in national borders drawn during the post-colonial period. The wounds of the War of the Pacific, in which Bolivia lost its only province with access to the sea to Chile, remain raw for many Bolivians. The repercussions of this animosity are still being felt as Bolivia refuses to provide energy resources to Chile. Since the end of the 2000s, there have also been significant tensions between Colombia and Venezuela. Despite these ongoing strains, the continent is becoming more and more integrated. Human and capital flows are on the rise, albeit oriented towards the US. In North America, the USMCA (United-States, Mexico, Canada Agree has established an area where capital and goods circulate freely. Its equivalent in the South is MERCOSUR.

 

The region’s troubled internal relations may give rise to groups of attackers aiming to take advantage of its geopolitical instability and set off an explosion of cybercrime within the region and beyond.

Main types of Attackers

State Sponsored
Cyber Criminal
Cyber Terrorist

Adversary types

Top 3 Attacked sectors

  1. Retail
  2. Transportation
  3. Education

South America News

See more

​In recent decades, urban conflicts have erupted throughout Latin America in response to several phenomena including poverty and rising inequality. As for international clashes, several Central and South American countries have been in conflict for many years. Meanwhile, the same countries are often plagued by internal tensions, as populations searching for a new socio-economic order make their grievances known through a variety of protest movements

 

_ECONOMIC MODELS IN LATIN AMERICAN COUNTRIES

Boosted by growth in the early 2000s thanks to sluggishness in the US, South America has seen some economic success. Brazil, for example, is one of the five emergent economies known as the BRICS countries. However, since 2011, this growth has been merely relative, and most Latin American countries have slid into recession. In fact, after a “golden decade” between 2003 and 2013, during which economies boomed and inequalities narrowed, Latin America’s GDP (Gross Domestic Products) per capita had collapsed to 2010 levels by the end of 2020. The price of exported primary commodities has weighed heavily on countries’ financial capacities as well as their economic growth. The fossil fuels sector has also been a factor in this crisis: in 2014, oil prices plummeted in Argentina, Brazil and Venezuela.

 

_REGIONAL DIVISIONS STOKING BORDER CONFLICTS

Border conflicts in this region are nothing new. For hundreds of years, Latin America has been the setting for several international conflicts, with some still ongoing that stretch back to the 19th century. Today, political disagreements between countries continue for a variety of reasons, including various permutations of nationalism and conflicts of economic interest. These battles are fought in the raw materials sector, particularly oil and gas, as well as within the framework of increasingly fragile regional alliances. On 1 May 2006, Evo Morales nationalised Bolivia’s oil wells, hitting Brazilian company Petrobras (a third of whose shares are owned by the Brazilian government) particularly hard and impacting other foreign companies including Spain’s Repsol. In response to objections by Brazil, backed by Argentina, Bolivia gained the support of Venezuela, resulting in a temporary schism between the region’s left-wing governments. Furthermore, more than ten years after its founding treaty was signed, the Union of South American Nations (UNASUR) is now moribund. In 2018, six of its 12 members announced their temporary withdrawal from the union and suspended their financial contributions in response to the organisation’s collective inability to designate a new secretary general to succeed the former president of Colombia. This institutional breakdown is the result of these countries’ shift towards nationalism and prioritisation of their own economic interests, which has aggravated regional divisions and conflicts between countries.

Their inward turn is hardly surprising, as many of them had endured or continue to endure deep economic, political and social crises. These situations dampen the driving force that motivates earnest cooperation and regional projection, instead favouring policy focused on the internal welfare of the nation.

 

_FOREIGN POWERS CAN TAKE ADVANTAGE OF DETERIORATING REGIONAL UNITY THROUGH ESPIONAGE ACTIVITIES

This was the case with ATK97, known as “El Machete”, a cyberespionage group that has been active since 2010. Its agents usually target the governmental and military sectors in Latin America as well as the US, Korea and several European countries. The source code of the group’s malware, which it usually deploys in sophisticated spear phishing attacks, suggest that the developers are Spanish speakers. The question of potential sponsorship of the attacking group by a foreign power remains unresolved. Most of the victims of the group’s 2010 campaign of attacks were in countries such as Venezuela, Ecuador, Colombia, Peru and Cuba.

Finally, it is interesting to note the large number of countries around the world that target this region with cyberattacks. In February 2021, of the ten main countries from which attacks targeting Brazil, Chile, Colombia and Panama originated, China was the source of 23,583 attacks, Germany 10,847 and the US 10,019.

 

_INTERNAL CONFLICTS

The social and political consequences of the economic crisis of the 2020s have weakened Latin Areas of tension in the South American region Suspected origin of attackers targeting this region American societies. The OECD has expressed concern at deteriorating social cohesion and growing alienation between citizens and public institutions in all countries in the region.

With the exception of Venezuela, where political and economic crises have triggered a humanitarian crisis, the resultant turbulence has manifested internally in other South American countries. Massive protests erupted in Paraguay in opposition to a decision by President Mario Abdo to sign an agreement with Brazil, considered disadvantageous to the small country, concerning the Itaipu hydroelectric power station.

Political tensions were particularly marked in countries such as Peru, where President Martín Vizcarra dissolved Congress, triggering new legislative elections. His actions led to protests throughout the country. In one case, protesters blocked access to a copper mine and forced it to halt production. In most countries, protests were caused by political decisions that may seem insignificant. However, such decisions can exacerbate inequalities, increase tension in society and sometimes result in a violent backlash by the population. This was the case in Chile, in 2019, where a political decision was made to increase ticket prices on the Santiago Metro.

This was merely a catalyst for a much broader protest movement challenging the Chilean economic model and spotlighting the country’s inequalities. Surging poverty and inequality, deteriorating public services and wage stagnation, combined with ever-increasing precarity and unemployment, have laid bare widespread dissatisfaction and defiance towards elites and governments. In addition, corruption scandals continue to come to light in a majority of countries, gradually undermining the legitimacy of political systems and institutions as the public discovers their extent. The Odebrecht case embodies the current situation with regard to corruption. Some 10 countries have been impacted by the scandal, which led to the downfall of Peruvian president Pedro Pablo Kuczynski. All of these factors have coalesced to breed discontentment within Latin American societies and foster a feeling of insecurity. Rising crime, whether tangible or virtual, has made the region one of the most dangerous in the world. Latin America is home to 40 of the 44 cities where criminal activity poses the most severe threat. For instance, El Salvador, Honduras and Guatemala have the highest homicide rates in the world. Much of this urban violence is perpetrated by gangs, specialized in drug trafficking. Indeed, due to its geography, Latin America is an active participant in the drug trade, notably providing the US with cocaine. Figures show that 80% of cocaine arriving in the country transits through Central America. This lucrative and straightforward business has led to the formation of thousands of small, violent gangs across the region (including maras, Mexican cartels and Brazilian mafia organisations). Law enforcement and politicians are often powerless to stop them, and the rot is often worsened by corruption and public officials accepting bribes.

 

_LATIN AMERICA’S INSTABILITY HAS LED TO WIDESPREAD PRECARITY, OPENING THE DOOR FOR CYBERCRIMINALS TO CONDUCT VARIOUS TYPES OF ATTACK CAMPAIGNS BOTH WITHIN THE REGION AND AROUND THE WORLD

These groups include ATK237, also known as the Tetrade. This malware family, of Brazilian origin, is characteristic of the country’s cybercrime landscape. Until 2011, it primarily targeted Brazilian victims, before expanding its focus worldwide. It comprises four malware families called GUILDMA (aka Astaroth), GRANDOREIRO, JAVALI (aka Osaban) and MELCOZ. Cybersecurity researchers from Kaspersky Lab identified this series of malware as being responsible for attacks on financial institutions in Brazil, other Latin American countries and Europe. The Brazilian cybercriminal underground is known to be particularly geared towards the development and sale of banking trojans. Finally, the group ATK243 (aka Carbanak or Anunak) is worth highlighting in order to demonstrate cybercrime’s important place in this part of the world. The ATK243 label was assigned to resolve confusion between the aliases FIN7 and Carbanak/Anunak, two groups which are tracked as a united operation. Their common feature is the use of the malware Carbanak. Note that, despite its shared interests with ATK32, ATK243 is a separate group. ATK243 was first identified in 2013. Since then, they have attempted to attack up to 100 banks, electronic payment systems and other financial institutions in around 30 countries, including Brazil. According to data from Kaspersky Lab, Cabarnak’s targets include financial institutions in Russia, the US, Germany, China,Ukraine, Canada, Hong Kong, Taiwan, Romania, France, Spain, Norway, India, the UK, Poland, Pakistan, Nepal, Morocco, Iceland, Ireland, the Czech Republic, Switzerland, Brazil, Bulgaria and Australia.

 

_LATIN AMERICA AND COVID-19

Covid-19 has caused over 1.5 million deaths in Latin America and the Caribbean, according to an AFP study of official figures.

The early stages of the epidemic were characterised by uncertainty, as the region was initially only marginally affected. However, Latin America quickly became the hardest-hit region in the world (and remained so until October 2020, when the changing seasons put Europe back in the lead), representing more than a quarter of the planet’s cases and a third of its deaths with just 9% of its population.

The Covid death toll in Brazil has exceeded 600,000, making it the country with the second-most deaths after the United States. Mexico, Peru, Colombia and Argentina had the highest mortality rates after Brazil. In October 2021, Brazil was continuing to suffer heavily, with the highest daily number of cases in the region.

Despite improvement, epidemics have afflicted Latin America for decades, and the region accounts for a disproportionate share of health and economic costs as a result. These challenges are compounded by rising hunger, economic hardship, widening inequalities and a rapidly approaching hurricane season. Hunger and food insecurity have the potential to generate widespread conflict, provoke political turbulence and force vulnerable families to flee.

Consequently, several indicators have shown that Latin America is on the verge of a major economic crisis due to Covid-19 in the medium term. Countries in the region lack resources, continue to fall deeper into debt and remain dependent on raw materials exports to regions in crisis, currently including China and Europe. The Economic Commission for Latin America and the Caribbean estimates that the pandemic will cause the region’s economy to shrink by 5.3%, with 29 million falling into poverty. South America will not return to its already poor pre-Covid status quo until 2023 at best, and possibly not until 2030.

_THE INSTABILITY CAUSED BY COVID-19 IS EXPECTED TO LEAD TO MANY ATTACK CAMPAIGNS AGAINST LATIN AMERICAN COUNTRIES, PARTICULARLY BRAZIL

Cybersecurity company Fortinet recorded more than 2.6 billion cyberattack attempts in Brazil between January and June 2020, out of a total of 15 billion attempts in Latin America and the Caribbean. COVID has also led to an increase in the use of phishing techniques by attackers. Cybercriminals would share messages on WhatsApp aiming to steal the victim’s personal data for use in future attacks or trick the victim into downloading legitimate applications in order to collect payment from affiliate programmes. Many elements of critical infrastructure in Brazil have been targeted since the start of the Covid-19 pandemic. In 2020, the country saw a rise in brute force attacks due to the increase in remote working. For instance, the infamous ransomware REvil, also known as Sodinokibi, was one of the first to take advantage of the pandemic to launch attack campaigns. In July 2020, REvil’s operators (ATK168) demanded a ransom of $14 million from Brazilian electricity provider Light SA. In 2021, Centrais Eletricas Brasileiras (Eletrobras) and the Companhia Paranaense de Energia (Copel), two major public electricity providers, announced that they had suffered ransomware attacks in the last week. In Copel’s case, the attack was the work of the Darkside ransomware gang, who claim to have stolen more than 1,000GB of data including sensitive infrastructure access information and the personal details of top management and customers. The attack on Eletrobras affected servers on the company’s administrative network and had no impact on the operations of nuclear power stations Angra 1 and Angra 2.