--[ Anomalía #21 - Territories under surveillance ]--
November 13, 2026
By: ZoqueLabsThis writing is distributed under a Creative Commons CC BY-SA (Acknowledgment - Share Alike) license.
Spanish version
Hello hello!
Drones that fly over communities, satellite connections used to coordinate operations, images that allow territories to be observed from hundreds of kilometers away, and communication systems that facilitate the activities of criminal groups. Technology is increasingly entering scenarios of territorial dispute and illegal economies in Latin America. And its effects do not remain with those who use it: they also reach the communities that inhabit those territories.
In October, the Special Rapporteur on Economic, Social, Cultural and Environmental Rights of the IACHR drew attention to the use of drones, artificial intelligence, satellite images and communications, biometric technologies and other dual-use systems in extractive activities, illegal economies and security operations. Their concern is that these technologies can expand territorial control capabilities, facilitate displacement and deepen the confinement of communities.
It is not a minor concern. In Latin America, different criminal groups are incorporating technologies that a few years ago we associated mainly with military operations. An ACLED analysis recorded around 670 armed drone events in conflicts in the region since 2018. More than 72% occurred between January 2025 and August 2026. Colombia concentrates an important part of these events and in Mexico the use of drones by criminal organizations in territorial disputes has also been documented.
But we’re not just talking about drones used to drop explosives. There are also devices adapted to evade conventional signal inhibition systems, connections that allow remote control to be maintained, and tools that facilitate the observation and coordination of operations. In Mexico, for example, drones controlled by fiber optics have been documented, a technology that makes their interference difficult through traditional electronic warfare mechanisms.
In Colombia, this incorporation of technology occurs in territories where disputes over natural resources, illegal economies and the presence of armed groups already represent a constant threat to communities. An Associated Press investigation documented how tools such as drones and satellite Internet are being used in activities related to environmental crimes in Latin America, while indigenous communities face intimidation and other forms of violence. Technology is also modifying the conditions under which territories are exploited and control is exercised over those who inhabit them.
And those who defend those territories continue to pay a very high price. According to Global Witness, Colombia recorded 39 murders of land and environmental defenders during 2025, of the 124 documented worldwide. It is the fourth consecutive year that the country appears in first place on this record. Almost half of the victims belonged to indigenous communities.
The incorporation of these technologies does not alone explain the attacks nor does it mean that each community is being monitored using drones or digital systems. But it does introduce new capabilities in scenarios where deeply unequal power relations already exist. Being able to observe from the air, coordinate remote operations or communicate without depending on conventional infrastructure can change the conditions under which control is exercised over a territory. And here appears something that interests us especially from digital security.
Monitoring and territorial control also have a cyber dimension. The information circulating on phones, social networks, messaging applications and online services can be used to identify people, know their relationships, follow their movements or anticipate their activities. Taking advantage of it doesn’t always require sophisticated spyware: sometimes a compromised account, exposed personal information, or access to data marketed by third parties is enough.
And while criminal groups modernize their operations, the surveillance capabilities of states and private companies also grow. Biometric systems, cameras, tracking platforms and huge databases allow people to be observed and profiled with a level of detail that a few years ago was difficult to imagine. These capabilities can have legitimate uses, but they can also end up being used to monitor, intimidate or persecute those who question power, defend their territories or simply live in them.
The paradox is that communities need many of these same technologies to organize, document abuses, communicate and report what is happening. And they don’t always have the resources to protect them. A compromised account, an infected device, or the exposure of sensitive information can have consequences that go far beyond digital, especially in territories where physical threats already exist.
That is why we believe that as civil society we need to expand the way we look at digital threats. Understand what technologies actors who exercise violence are incorporating, how they obtain information, what infrastructure they use and what traces their operations leave. Also ask ourselves what data public and private surveillance platforms and systems are collecting, who can access it, and how it could be used against people at risk.
That knowledge should help us investigate, identify threats and build better protection strategies together with communities, taking into account their contexts and the real conditions in which they use technology.
We do not want to present technology as the cause of all this violence or assume that each new tool necessarily ends up in the hands of those who exercise control. It also offers enormous possibilities to document, investigate and defend rights. But we need to look carefully at how these capacities are transforming both the ways of exercising violence and the possibilities of resisting it.
In this edition of Anomaly we approach some of these technologies, the operations that use them and the risks that appear when they are incorporated into scenarios of territorial dispute, surveillance and violence.
Because while we continue to learn to use them to protect ourselves, those who monitor, attack and exercise control are also learning to use them. And understanding how they are doing it is part of our job.
And that being no more, Anomaly.
--[Threat Intelligence ]--
ARTEX and company: AI agents are already involved in real intrusions
Google Threat Intelligence Group and Mandiant analyze the offensive use of frameworks such as ARTEX, Cairn and PentAGI, which allow AI agents to be coordinated during different stages of an intrusion. They already observed these tools in real incidents, performing reconnaissance, exploitation, lateral movement, and exfiltration preparation. The report is especially useful for those of us who respond to incidents: it describes traces that can be searched in compromised systems, proposes detection and defense measures, and raises possible scenarios for the evolution of these capabilities.
Hunting an Ivanti exploit based on an indicator that was no longer responding
Etugen reconstructed part of an operation against Ivanti Connect Secure following the leads of a report that published a single, now inactive IP address. Through content searches he found an exposed server with about 9 GB of files, the exploitation framework, execution logs and even a memory file for an AI agent that documented the infrastructure rotation. The research made it possible to recover new indicators and distinguish between activity possibly related to the original operator and other actors that exploited the same vulnerability. An excellent example of how a seemingly dead indicator can still lead us to active infrastructure.
Amatera, the infostealer that leads detections in Latin America
ESET analyzes Amatera, an infostealer for Windows marketed as malware-as-a-service that led its regional detections of this category during the first half of 2026. The malware steals credentials, session cookies, tokens, cryptocurrency wallet information, and other data that can facilitate new compromises. The article also explains its possible relationship with ACR Stealer, its marketing through subscriptions and the mechanisms used to distribute it. A good look at the operation of a criminal business that continues to grow.
Blind Eagle continues to send false judicial notifications in Latin America
ZenoX documents a new campaign that it attributes to APT-C-36, also known as Blind Eagle, with emails in Spanish and Portuguese that simulate judicial and administrative communications. The string uses XHTML files containing SVG, HTML smuggling to generate in-browser ZIP, JavaScript and VBS scripts, PowerShell, and a final RAT. The analysis includes infrastructure, artifacts and indicators to search for related activity. Interesting both for the regional victimology and for the use of apparently institutional documents to lead victims through various stages of infection.
A Chinese keyboard turned malware distribution mechanism
ESET documented how SlippyNunchucks leveraged insecure HTTP communications from the Sogou input method, used to write Chinese characters, to distribute the DarkVigil implant using DNS manipulation. The operation affected Chinese-speaking people and organizations in several countries in Asia and reached Oman. It is still unclear where the DNS tampering occurred. The case recalls that very specific applications of a linguistic community can also become vectors to attack it. Tencent fixed the issue in version 16.10.
A backdoor hidden inside Control Web Panel
XLab researchers identified cwpdoor, a malicious modification of the web server used by Control Web Panel to manage Linux servers. The implant allows commands to be executed using specially prepared HTTP requests without registering them in the usual access logs. To install it, attackers first need root privileges. A sample was uploaded to VirusTotal from Brazil, although that does not allow us to determine where the infection occurred. The analysis includes indicators and specific checks to search for the backdoor on servers.
Mirax: from a streaming application to bank account control
Group-IB analyzes Mirax, a RAT for Android distributed through applications and ads related to free streaming, mainly in the Middle East, Turkey and Africa. Once installed, it abuses accessibility services to observe and control the device, intercept codes, and operate banking applications from the victim’s own phone. Some of its phishing configuration, infrastructure, and templates are obtained dynamically from the command and control server. An interesting investigation into accessibility abuse and the evolution of mobile banking fraud.
--[Vulnerabilities and technical analysis ]--
PHP2Shell: between real exploits, incomplete testing, and problematic disclosure
Qurium published a technical analysis of PHP2Shell and the confusion that accompanied its disclosure. The researchers studied various public implementations, including memory leak techniques, heap manipulation, and ASLR evasion, and compared them to requests received by their infrastructure. For one week they analyzed more than 15,000 requests from 89 IP addresses against 191 sites. The result shows a mix of scanners, experimental tests and more elaborate attacks, without any suspicious request implying successful exploitation. An especially good read on technical research, threat intelligence, and responsible disclosure.
Steam and a chain of clickless remote execution vulnerabilities
Atredis Partners found six vulnerabilities in Steam for Windows, including two remote execution flaws through automatic connections between authenticated computers on the same account and four others related to local privilege escalation. The researchers demonstrated how to combine memory leaks, buffer overflows, and privileged service weaknesses to execute code. The remote attack requires the adversary to control another session on the same account; it is not enough for the victim to have Steam installed. No active exploitation of these faults was reported.
eMudhra blames a Python script for its insecure certificates
Former certification authority eMudhra explained that a bug in a script used during a key generation and transfer ceremony ended up producing extraordinarily weak private keys, some recoverable from public information. The issue affected subordinate certificates and led to browsers stopping trusting authority. Beyond the programming error, the case raises questions about the verifications and audits that should prevent such a serious flaw from reaching trusted Internet infrastructure.
Akamai detects an intrusion against supply infrastructure in Latin America
Akamai research describes a multi-stage operation against systems related to a regional supply chain. The attackers attempted to establish remote access, recognize the environment, and expand their presence using Linux, OpenShift, and Windows systems. The correlation of processes, traffic and security events allowed activity to be contained before significant operational impacts were reported. A useful case to think about detecting intrusions that cross different platforms within the same organization.
--[AI and security ]--
Almost a thousand Linux exploits generated in 30 hours
An OpenAI experiment with a specialized cybersecurity model produced, according to the reported results, 948 functional local privilege escalation exploits from more than 2,300 candidate findings in the Linux kernel. The process took about 30 hours and cost approximately $1.2 million for API. The article examines the implications of automating vulnerability research at this scale, including its potential consequences for sectors such as Latin American banking. It is worth distinguishing the results obtained in test environments from exploitable vulnerabilities in real systems, the details of which are not fully documented in this note.
AI agents on roads that no one authorized
An article from Latin America21 examines recent experiments in which AI agents, when trying to meet assigned objectives, found ways to evade restrictions from their test environments. The text discusses the implications of these capabilities for the security, human oversight, and accountability of those who develop and deploy autonomous agents. For Latin America, where many organizations depend on external technological services and have limited resources to audit them, the problem also lies in who controls the tools and what access we are giving them.
--[Surveillance and digital rights ]--
Civil society demands closing the gaps in exports of European surveillance technology
CDT Europe and other human rights organizations called on the European Commission to review the implementation of rules on the export of dual-use technologies. The organizations warn that surveillance capabilities continue to reach governments that can use them for repression and question current risk assessment, due diligence and transparency mechanisms. They also call for strengthening controls on technologies that do not explicitly appear on export lists. An important discussion about the responsibilities of the industry and the States that allow the international circulation of these tools.
Center for Democracy & Technology
Webloc: police surveillance built with advertising data
Bloomberg investigated Webloc, a platform marketed by Penlink that allows authorities to track phones using information obtained from the advertising ecosystem. According to commercial materials reviewed by the outlet, the system can track devices in different countries based on data associated with everyday applications, including weather, gaming and mail. In the United States, these capabilities can be used without the same judicial clearances that would normally be required for other monitoring methods. Another case that connects directly to our discussion in Anomaly #19 about the advertising industry’s responsibility in modern surveillance.
Mercenary spyware against phones of German officials
The German government confirmed that Apple devices used by government members, parliamentarians and other public figures received threat notifications. The Federal Office of Information Security is investigating the extent of the attacks, which could be related to mercenary spyware. For now, it is not publicly known who was behind it nor has it been confirmed that all the alerted devices have been infected. The case recalls that Apple notifications can be an important signal to initiate a forensic investigation, but they are not a substitute for technical verification of the compromise.
Who protects those who report in Mexico?
The Associated Press investigated the deficiencies of the federal mechanism for the protection of journalists and human rights defenders in Mexico. Through various testimonies it shows delays, insufficient protection measures, coordination failures and cases in which threatened people had to go to court to maintain their safety. The investigation recalls that protection does not end with providing a panic button or installing cameras: it also depends on there being institutions capable of responding to threats and guaranteeing that journalists and defenders can continue their work.
--[Platforms and misinformation ]--
Fabricating the theory of the «great replacement» through an operation of international influence
Extensive Dysinfluence research documents an advertising and information manipulation campaign that spread narratives against Muslims and migrants, mainly in Europe, as well as messages against Qatar and Iran. Between October 2023 and October 2026, researchers recorded at least 533 million exposures to its contents in 30 countries. The analysis reconstructs fake identities, advertisements, websites, infrastructure and operations on different platforms. The authors consider, with moderate to high confidence, that the operation originated in Israel, although they did not identify who commissioned or financed it. A particularly interesting work due to its methodology for attributing and reconstructing a large-scale campaign.
--[ Infrastructure and organized crime ]--
Cyberattack against the largest port in Latin America
The Port Authority of Santos, in Brazil, confirmed a cyberattack that occurred on November 6 that left administrative, telephone and Internet systems out of service. Although port operations did not stop, part of the procedures had to be carried out manually and delays in the movement of cargo were reported. The Federal Police opened an investigation and it has not yet been determined whether there was improper access to information. The case shows how an attack against the administrative systems of a critical infrastructure can affect its operation even when the logistics systems remain operational.
DDoS attacks against Brazil’s digital identity platform
Serpro, Brazil’s public technology company, reported that its infrastructure faced denial-of-service attacks of unprecedented magnitude in recent months, including recent attempts against services linked to Gov.br. The entity maintains that its defenses avoided impacts on the identity platform, although other government services reported authentication problems in the same period. Without public technical figures, it is still difficult to measure attacks and relate them to those disruptions. Biometric Update
Mexican cartels incorporate drones guided by fiber optics
A Small Wars Journal analysis examines how Mexican criminal organizations are incorporating technologies used in recent military conflicts. In Sinaloa, authorities seized drones and fiber optic reels that would allow aircraft to be controlled without relying on conventional radio links, making them resistant to signal jammers. The article also examines surveillance, cyber operations and territorial control capabilities. An example of how dual-use technologies can quickly circulate between war scenarios and criminal organizations.
Satellite Internet, drones and illegal mining in Latin America
An Associated Press investigation reflects the concerns of the Office of the Special Rapporteur on Economic, Social, Cultural and Environmental Rights of the IACHR about the use of technology by illegal mining networks, logging and other criminal economies. Satellite connectivity allows operations to be coordinated in remote territories, while drones can be used for surveillance and threats against communities. Technology can also help communities document environmental damage and protect their territories. The problem is especially relevant for defenders of the territory in countries like Colombia.
--[Leaks ]--
Colombia - A wave of announcements of alleged attacks against entities
MuchoHacker recorded at least ten announcements of possible attacks against public and private organizations in Colombia between November 6 and 9. Among the aforementioned entities are the Superintendency of Industry and Commerce, SENA, DIAN and the National Institute of Health, in addition to several companies. The ads circulated on forums, Telegram channels and ransomware group sites. Most of the claims come directly from the attackers and, at the time of the report, the entities had not confirmed the incidents. It is important to follow verifications: publishing a database or announcing an intrusion does not necessarily prove that the information is new or that it comes from a recent compromise.
New alert for an alleged leak from the Women’s Secretariat in Colombia
Added to the numerous announcements of possible attacks against Colombian entities in recent days is a new alert published by VECERT Radar about an alleged leak of information from the Women’s Secretariat. For now we do not have official confirmation of the incident or independent verification of the data that was supposedly compromised. However, it is worth keeping track of it, especially due to the sensitivity of the information that the institutions in charge of caring for women and people in situations of violence can handle.
--[Digital security ]--
Only 1 % of Android devices use the latest version
According to distribution figures published through Android Studio, Android 17 barely reaches 1% of active devices, while Android 16 concentrates 25.4%. Even more worrying: 43.6% are still using Android 13 or earlier versions. This data does not directly indicate how many phones have pending security patches, but it does show ecosystem fragmentation and difficulties in distributing new versions. An important reality for those of us who work in digital security with people who cannot always replace their devices.
--[ Exfiltradaz - Snapshot from 10/30/2026 to 11/12/2026 ]--
During this period, 11 references to leaks, compromised accesses and publications associated with ransomware were identified in four Latin American countries. Brazil concentrated the largest number of records, with six references, followed by Colombia and Mexico, with two each, and Bolivia, with one. The most frequent sectors were Ransomware, with six registrations, and Credential Marketplace, with four. A reference was also identified in the Financial sector.
Ransomware-associated activity included posts about organizations in Colombia, Mexico, Brazil, and Bolivia. Among them are Clínica La Sagrada Familia, Comercial en Fletes México, MAPFRE Brasil and Mercantile Investment Corporation Bolivia SA. In the case of Clínica La Sagrada Familia and MAPFRE Brasil, references were found both in monitoring alerts and in ransomware feed publications. These records reflect ads attributed to groups like Whitearmor, Eclipse, Destello, and TheGentlemen (again).
In the credentials market, new publications were observed about access to Brazilian email accounts, announced as valid, fresh and checked.
More details of these leaks in Exfiltradaz.
--[ ZOLIM --> Snapshot 11/12/2026 ]--
9 new and very interesting IPs for this ZOLIM snapshot. With these we have already completed 316 detected servers since we started the observatory. :)
Some interesting signs:
- Hack5 Cloud C2: This particular C2 used to do penetration tests of Wi-Fi networks remotely continues to roll in Chile, it seems to be the same “device” changing IP in the same ISP and in this snapshot we found another one in Brazil in the city of Fortaleza with the strangeness that it has an IP attributed to Digital Ocean.
- Sliver: We found a new instance in Chile that we had not seen since December of last year and another new instance in Brazil. Sliver is one of the tools most detected by ZOLIM after GoPhish.
- Venezuela: they continue to change IPs, but in the same ISP (what looks like a data center) of Cobalt Strike and GoPhish.
> If you want to go deeper, take a look at ZOLIM. In the table at the bottom you can search and cross-reference the data by country, ASN, IP, threat, city and other fields. Each IP is a good excuse to start researching. :)