APT (advanced persistent threat) group profiles focused on Latin America and Colombia: attribution, MITRE ATT&CK TTPs, public sources and detection guidance. By Ventura Systems.https://intelligence.venturasystems.tech/en-ushttps://intelligence.venturasystems.tech/apt/apt-c-36/https://intelligence.venturasystems.tech/apt/apt-c-36/Group that MITRE describes as a suspected South American actor, active since at least 2018, combining espionage and financial fraud against government, banking, energy and other sectors in Colombia, Ecuador and the rest of Latin America.Sat, 03 Oct 2026 00:00:00 GMTespionagefinanciallatamhttps://intelligence.venturasystems.tech/apt/apt28/https://intelligence.venturasystems.tech/apt/apt28/Cyberespionage group attributed by the U.S. and the UK to Unit 26165 of Russia's GRU (85th GTsSS), active since at least 2004 against governments, defense, logistics and political organizations.Sat, 03 Oct 2026 00:00:00 GMTespionagelatamhttps://intelligence.venturasystems.tech/apt/apt29/https://intelligence.venturasystems.tech/apt/apt29/Cyberespionage group attributed by the U.S. and the UK to Russia's Foreign Intelligence Service (SVR), active since at least 2008; responsible for the SolarWinds compromise and for persistent intrusions into cloud and identity environments.Sat, 03 Oct 2026 00:00:00 GMTespionagelatamhttps://intelligence.venturasystems.tech/apt/apt41/https://intelligence.venturasystems.tech/apt/apt41/Chinese group that combines state-sponsored espionage with operations for personal profit, active since at least 2012 against healthcare, telecommunications, technology, government and the video game industry.Sat, 03 Oct 2026 00:00:00 GMTespionagefinanciallatamhttps://intelligence.venturasystems.tech/apt/kimsuky/https://intelligence.venturasystems.tech/apt/kimsuky/North Korean cyberespionage group active since at least 2012, focused on foreign policy, national security and nuclear issues on the Korean Peninsula, that targets governments, think tanks, academia and defense through spearphishing and social engineering.Sat, 03 Oct 2026 00:00:00 GMTespionagelatamhttps://intelligence.venturasystems.tech/apt/lazarus-group/https://intelligence.venturasystems.tech/apt/lazarus-group/North Korean state-sponsored group attributed to the Reconnaissance General Bureau (RGB), active since at least 2009, that combines espionage, sabotage and financial theft against banking, crypto assets and defense, with documented cases in Latin America.Sat, 03 Oct 2026 00:00:00 GMTespionagefinancialsabotagelatamhttps://intelligence.venturasystems.tech/apt/muddywater/https://intelligence.venturasystems.tech/apt/muddywater/Cyberespionage group that the FBI, CISA, US Cyber Command and the UK's NCSC identify as a subordinate element of Iran's Ministry of Intelligence and Security (MOIS). Active since at least 2017 against governments, telecommunications, energy and finance.Sat, 03 Oct 2026 00:00:00 GMTespionagelatamhttps://intelligence.venturasystems.tech/apt/sandworm/https://intelligence.venturasystems.tech/apt/sandworm/Sabotage and espionage unit attributed to Russia's GRU Unit 74455, active since at least 2009 and responsible for the blackouts in Ukraine and for NotPetya, one of the most destructive cyberattacks on record.Sat, 03 Oct 2026 00:00:00 GMTsabotageespionagelatam