Guacamaya

Executive Summary

Guacamaya represents a cyber threat group conducting hack-and-leak operations primarily in Latin America. They target military, police, and mining sectors, aiming to expose information to reveal ties between these entities and environmental degradation and repression of native populations. The group's activities are regionally focused but have significant implications for targeted organizations.

Goals & Targeting

Guacamaya targets sectors they believe contribute to environmental degradation and social repression, such as military, police agencies, and mining companies. Their focus is on Latin American countries involved in these industries. By targeting these sectors, the group seeks to influence public perception, drive policy changes, and promote social justice through the exposure of sensitive information.

Guacamaya is a cyber threat actor known for their hack-and-leak campaigns against military, police agencies, and mining companies across Latin America. Their primary targets include state institutions and corporate actors involved in industries perceived to contribute to environmental damage or social repression of indigenous populations. Guacamaya's operations are politically motivated; they seek to expose sensitive information and internal communications to the public through leaks. This approach aims to raise awareness about environmental issues, promote transparency, and bring attention to human rights violations, aligning their activities with a broader hacktivist agenda.

Key Capabilities

• Cyberattack execution
• Data exfiltration
• Spear-phishing campaigns
• Network intrusion

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Guacamaya's campaigns are characterized by their focus on Latin American targets. Their operational strategy involves compromising systems, extracting sensitive data, and leaking it to the public, often through forums or news outlets. Notable past operations include attacks against mining companies and law enforcement agencies in countries where environmental issues are prominent.

IOC Patterns

• Spear-phishing emails targeting military and police sectors
• Use of custom tools for network intrusion

Recommended Actions

• Monitor spear-phishing attempts targeting state institutions
• Enhance access controls and implement multi-factor authentication
• Conduct regular security audits and vulnerability assessments
• Implement log monitoring and analysis capabilities to detect potential intrusions

Suggested Tags