{
	"id": "b5d61f1c-c24c-41e9-9d06-140caac7435b",
	"created_at": "2026-04-06T00:10:19.099605Z",
	"updated_at": "2026-04-10T13:11:43.722445Z",
	"deleted_at": null,
	"sha1_hash": "abfa01aa7d4d5b18235b02999450d9d9e9af2b42",
	"title": "Guacamaya hacktivists stole sensitive data from Mexico and Latin American countries - RedPacket Security",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 43918,
	"plain_text": "Guacamaya hacktivists stole sensitive data from Mexico and Latin\r\nAmerican countries - RedPacket Security\r\nBy March 30, 2026\r\nPublished: 2022-10-01 · Archived: 2026-04-05 19:08:05 UTC\r\nA hacker group called Guacamaya stole classified government information from\r\nmultiple military and government agencies across several Latin American\r\ncountries.\r\nAmong the data stolen by a group of hackers called Guacamaya (macaw in Spanish) there was a huge trove of\r\nemails from Mexico’s Defense Department, which shed the light on the poor resilience of the country’s\r\ninfrastructure to cyberattacks due to poor investment and awareness.\r\nThe Guacamaya group claimed to have stolen six terabytes of data, including data related to the kidnap of 43\r\nstudents by local police and allegedly handed over to be killed by a drug gang in 2014.\r\nThe news of the data breach suffered by the Defense Ministry was confirmed by Mexican President Andres\r\nManuel Lopez Obrador, he did not provide details about the hack only explained that threat actors exploited a\r\nchange in the military’s IT systems.\r\nThe hack also revealed details about his health condition of the President that is affected by a form of angina and\r\nthe monitoring of the U.S. ambassador to Mexico.\r\nRecently the Chilean Army’s Joint Chiefs of Staff suffered a data breach, the Guacamaya hackers had access to its\r\nemails and published more than 400,000 messages containing private information regarding the Army and the\r\nMinistry of Defense. According to the media, the security breach also affects Chile’s police forces.\r\nThe group also stole emails from the militaries in El Salvador, Peru and Colombia, as well as El Salvador’s\r\nNational Police.\r\n“This did not happen by chance,” he said.\r\nAccording to Solano and other analysts consulted by Reuters, the vulnerability exploited by the hackers stemmed\r\nfrom a weakness in a Microsoft server detected last year, known as ProxyShell.\r\nFollow me on Twitter: @securityaffairs and Facebook\r\nPierluigi Paganini\r\n(SecurityAffairs – hacking, Guacamaya)\r\nhttps://www.redpacketsecurity.com/guacamaya-hacktivists-stole-sensitive-data-from-mexico-and-latin-american-countries/\r\nPage 1 of 2\n\nThe post Guacamaya hacktivists stole sensitive data from Mexico and Latin American countries appeared first on\r\nSecurity Affairs.\r\nIf you like the site, please consider joining the telegram channel or supporting us on Patreon using the button\r\nbelow.\r\nOriginal Source\r\nPost navigation\r\nSource: https://www.redpacketsecurity.com/guacamaya-hacktivists-stole-sensitive-data-from-mexico-and-latin-american-countries/\r\nhttps://www.redpacketsecurity.com/guacamaya-hacktivists-stole-sensitive-data-from-mexico-and-latin-american-countries/\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.redpacketsecurity.com/guacamaya-hacktivists-stole-sensitive-data-from-mexico-and-latin-american-countries/"
	],
	"report_names": [
		"guacamaya-hacktivists-stole-sensitive-data-from-mexico-and-latin-american-countries"
	],
	"threat_actors": [
		{
			"id": "ae7c5e09-a79b-4dae-8ed3-f288b8d99810",
			"created_at": "2023-11-08T02:00:07.110982Z",
			"updated_at": "2026-04-10T02:00:03.416181Z",
			"deleted_at": null,
			"main_name": "Guacamaya",
			"aliases": [],
			"source_name": "MISPGALAXY:Guacamaya",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434219,
	"ts_updated_at": 1775826703,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/abfa01aa7d4d5b18235b02999450d9d9e9af2b42.pdf",
		"text": "https://archive.orkl.eu/abfa01aa7d4d5b18235b02999450d9d9e9af2b42.txt",
		"img": "https://archive.orkl.eu/abfa01aa7d4d5b18235b02999450d9d9e9af2b42.jpg"
	}
}