APT / THREAT GROUP

Guacamaya

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Guacamaya has conducted multiple hack and leak campaigns against military and police agencies and mining companies across Latin America, which they believe have played a role in the region’s environmental degradation and repression of native populations.

Threat Analysis

Guacamaya is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://cyberscoop.com/environmentalist-hacktivist-collective-mining-company/

→https://srslyriskybiz.substack.com/p/recent-cyber-chaos-is-a-structural

→https://finance.yahoo.com/news/analysis-mexico-data-hack-exposes-003101651.html

→https://www.redpacketsecurity.com/guacamaya-hacktivists-stole-sensitive-data-from-mexico-and-latin-american-countries/

→https://research.checkpoint.com/2022/3rd-october-threat-intelligence-report/

→https://www.cyberscoop.com/central-american-hacking-group-releases-emails/

→https://therecord.media/mexican-army-spyware

Quick Facts

TypeAPT / Threat Group

Aliases1

SourceMalpedia

Also Known As

Guacamaya

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Guacamaya