Threat Intelligence Tarot
wands · 10
Latin America (environmental/political hacktivist)
★★★★★
risk 3/5
✦ The Jungle Eye ✦
Guacamaya
Mexican military (SEDENA)Colombian militaryChilean militaryGuatemalan policeMining corporations
Active since ~2022 · Latin American military exposure, Environmental activism, Anti-extractivism
From Latin American networks, The Jungle Eye watches governments that watch their own people. It breached Mexico's military and released six terabytes of secrets, including the president's medical records. It publishes what power wants hidden, and it does it in the name of the forest.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Mexican military leak - 6TB of SEDENA emails (2022)
- ◆AMLO health records included in leak (cardiac condition)
- ◆Colombian, Chilean, Peruvian military email archives published
- ◆Mining company environmental violations documentation release
Defenses
- ▸Urgent patching of Microsoft Exchange ProxyShell/ProxyLogonCIS Control 7 ↗
- ▸Email archive access controls and data classificationCIS Control 3 ↗
- ▸Government network segmentation and access loggingCIS Control 12 ↗
- ▸Data minimization - reduce what sensitive data is email-accessibleNIST CSF: PR.DS ↗
Reversed: Their Weakness
Guacamaya's exploitation of ProxyShell and ProxyLogon - vulnerabilities patched years before their attacks - revealed that Latin American military and government organizations had critically neglected basic patch management hygiene.
Share this adversary profile
swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.