122
Indicators
Properties
- Summary
- Latin American threat actor active since at least 2008 and documented by Citizen Lab in December 2015. Targeted journalists, opposition politicians and public figures in Argentina, Ecuador, Brazil and Venezuela with spear-phishing, fake news and activist sites, and off-the-shelf remote access trojan
- Summary source
- written 2026-10-25 from public vendor reporting (Citizen Lab 2015; Kaspersky/Symantec 2015; Kaspersky 2015; Mandiant 2020); not in ATT&CK
- In Signal since
- initial import (Sep 2026)
Explore this actor's full graph with Ninja Signal