Colombia's national cyber emergency team, colCERT, has issued a high-criticality alert on Emperador, a young double-extortion ransomware crew that it says reported 50 compromised organizations worldwide between August and October 2026, with Latin America accounting for 38% of them. The alert, AL-131, dated November 10, ranks Colombia as the second most affected country in the region.
According to colCERT, five Colombian organizations have been compromised, in strategic sectors including chemicals, transport, technology, and legal and professional services. Citing the crew's sustained activity, its confirmed presence in Colombia and the range of sectors hit, the agency rates the threat level as HIGH.
A crew that only appeared in August
Emperador began its public activity in August 2026, and colCERT describes a familiar playbook. The group gets in with valid credentials that were stolen or bought from initial access brokers (criminals who sell ready-made footholds into company networks), or by exploiting exposed remote services. Once inside, it sets up persistence, moves laterally using legitimate services such as RDP and WMI, and looks for repositories of high-value data. It then exfiltrates that data and deploys ransomware, threatening to publish what it stole on the dark web.
The alert maps this activity to MITRE ATT&CK techniques, including Valid Accounts (T1078) for initial access and Boot or Logon Autostart Execution (T1547) for persistence.
Emperador has surfaced on this site before: in September its leak site carried a claim against Brazil's tax agency. Leak-site victim counts are the crew's own claims and are not independently verified, which is part of why a national CERT documenting five domestic compromises carries weight.
MFA on remote access, backups kept offline
colCERT's guidance targets the entry points the group relies on. It urges organizations to strengthen controls on remote access, enforce multi-factor authentication (MFA), monitor for data exfiltration, and keep backups that are immutable and stored offline. Because Emperador's usual way in is a legitimate login rather than a software flaw, MFA on VPN, RDP and other remote services is the control most likely to stop it at the door, and watching outbound data is the best chance of catching it before the encryption stage.
For Colombian organizations, the alert adds to a run of colCERT warnings this year tracked on our Colombia country page. A crew that went from nothing to 50 claimed victims in three months, with nearly four in ten in Latin America, is a regional problem worth taking seriously before it grows into a larger one.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.