Colombia — Cyber Threat Profile
Colombia launched its National Digital Security Strategy 2025-2027 on 24 June 2025, after facing roughly 36 billion attack attempts in 2024, the second-highest total in Latin America, concentrated in financial, healthcare and energy networks. The plan rests on four pillars covering digital governance, workforce development and updated regulation. National CSIRT colCERT has since expanded its monitored base from about 31 to roughly 1,300 entities and 35,000 websites, and the incidents it managed fell from 1,427 in 2024 to 697 in 2025. Ransomware persists as the leading threat, with LockBit 3.0 and BlackCat reported as the most active variants against financial and public-service targets.- Data protection authority: Superintendencia de Industria y Comercio (source: CNIL)
- World Cybercrime Index 2024 (origin significance): 0.70 / 100, #37 worldwide
- Secure Internet servers per 1M people (2024): 1,126.2 (source: World Bank)
- Internet users (2024): 79.3% of population (source: World Bank)
Latest Colombia coverage
- Colombia warns of a new ransomware crew hiring affiliates 2026-08-26 · Ransomware
- Fake court notices spread AsyncRAT across Colombia 2026-08-19 · Cyber Incidents
- Ransomware crew mined crypto in Colombia before encrypting 2026-08-10 · Ransomware
- Crime service slips fake texts into real bank threads 2026-08-05 · Cyber Incidents
- Attackers keep access to SharePoint servers after patching 2026-08-05 · Vulnerabilities
- Fake court notices in Colombia install a data stealing worm 2026-08-04 · Cyber Incidents
- Colombia links a Remcos spyware case to Blind Eagle hackers 2026-08-03 · Nation-State
Threat actors targeting Colombia
- APT-C-36 APT
- Qilin Ransomware · 14 incident(s)
- LockBit Ransomware · 9 incident(s)
- The Gentlemen Ransomware · 8 incident(s)
- RansomHub Ransomware · 6 incident(s)
- SafePay Ransomware · 6 incident(s)
- KillSec Ransomware · 5 incident(s)
- Akira Ransomware · 4 incident(s)
- FunkSec Ransomware · 4 incident(s)
- Stormous Hacktivist · 4 incident(s)
- Meow Ransomware · 3 incident(s)
- Cl0p Ransomware · 2 incident(s)
- CMD Ransomware · 2 incident(s)
- DragonForce Ransomware · 2 incident(s)
- Everest Ransomware · 2 incident(s)
- INC Ransom Ransomware · 2 incident(s)
- Krybit Ransomware · 2 incident(s)
- APT73 Ransomware · 1 incident(s)
- Audit Team Ransomware · 1 incident(s)
- Deadlock Ransomware · 1 incident(s)
- FulcrumSec Ransomware · 1 incident(s)
- Hunters International Ransomware · 1 incident(s)
- Lynx Ransomware Ransomware · 1 incident(s)
- Majinahanashi Ransomware · 1 incident(s)
- NightSpire Ransomware · 1 incident(s)
- Payload Ransomware · 1 incident(s)
- Sarcoma Ransomware · 1 incident(s)
- ShinyHunters Ransomware · 1 incident(s)
- Space Bears Ransomware · 1 incident(s)
- GhostSec Hacktivist
- Machete APT
- SiegedSec Hacktivist
Most targeted sectors
- Healthcare 13 incident(s)
- Business & Professional Services 10 incident(s)
- Energy & Utilities 7 incident(s)
- Financial Services 7 incident(s)
- Manufacturing 7 incident(s)
- Technology 7 incident(s)
- Agriculture & Food 6 incident(s)
- Government & Public Sector 5 incident(s)
- Retail & Consumer 5 incident(s)
- Transportation & Logistics 5 incident(s)
- Hospitality & Tourism 2 incident(s)
- Telecommunications 2 incident(s)
Recent claimed incidents
- PIT.local 2026-09-04
- Transportes Montejo S.A.S. 2026-09-01 · Transportation
- PIO PIO 2026-08-16 · Retail & E-Commerce
- EPM 2026-08-05 · Energy & Utilities
- DUCON 2026-07-28 · Manufacturing
- Hardware Asesorias Software Ltda 2026-07-27 · Technology
- Anpra SAS 2026-07-21 · Business Services
- Ecopetrol 2026-07-19 · Energy
- NewNet 2026-07-18 · Telecommunication
- Saint George's School 2026-07-16 · Education
- Busscar de Colombia 2026-07-13 · Transportation/Logistics
- Hilo 2026-07-10
- DUFLO SAS (Duflo Servicios Integrales S.A.S.) 2026-07-03
- Fidelity Security Group 2026-06-28 · Financial Services
- Clínica La Sabana 2026-06-26 · Healthcare