Guacamaya (Spanish for '

macaw Macaws are a group of Neotropical parrot, New World parrots that are long-tailed and often colorful, in the Tribe (biology), tribe Arini (tribe), Arini. They are popular in aviculture or as companion parrots, although there are conservation con ...

') is an international group of

hacker A hacker is a person skilled in information technology who achieves goals and solves problems by non-standard means. The term has become associated in popular culture with a security hackersomeone with knowledge of bug (computing), bugs or exp ...

s that has published anonymous reports and leaked sensitive files in the public interest through

Distributed Denial of Secrets Distributed Denial of Secrets, abbreviated DDoSecrets, is a nonprofit whistleblower site founded in 2018 for news leaks. The site is a frequent source for other news outlets and has worked on investigations including Cyprus Confidential with o ...

and Enlace Hacktivista. It operates mainly in Central and Latin America and to date has hacked major corporations and the governments of

Chile Chile, officially the Republic of Chile, is a country in western South America. It is the southernmost country in the world and the closest to Antarctica, stretching along a narrow strip of land between the Andes, Andes Mountains and the Paci ...

Colombia Colombia, officially the Republic of Colombia, is a country primarily located in South America with Insular region of Colombia, insular regions in North America. The Colombian mainland is bordered by the Caribbean Sea to the north, Venezuel ...

El Salvador El Salvador, officially the Republic of El Salvador, is a country in Central America. It is bordered on the northeast by Honduras, on the northwest by Guatemala, and on the south by the Pacific Ocean. El Salvador's capital and largest city is S ...

Guatemala Guatemala, officially the Republic of Guatemala, is a country in Central America. It is bordered to the north and west by Mexico, to the northeast by Belize, to the east by Honduras, and to the southeast by El Salvador. It is hydrologically b ...

Mexico Mexico, officially the United Mexican States, is a country in North America. It is the northernmost country in Latin America, and borders the United States to the north, and Guatemala and Belize to the southeast; while having maritime boundar ...

and

Peru Peru, officially the Republic of Peru, is a country in western South America. It is bordered in the north by Ecuador and Colombia, in the east by Brazil, in the southeast by Bolivia, in the south by Chile, and in the south and west by the Pac ...

Motivation

The group says they're motivated by

anti-imperialism Anti-imperialism in political science and international relations is opposition to imperialism or neocolonialism. Anti-imperialist sentiment typically manifests as a political principle in independence struggles against intervention or influen ...

and

environmentalism Environmentalism is a broad philosophy, ideology, and social movement about supporting life, habitats, and surroundings. While environmentalism focuses more on the environmental and nature-related aspects of green ideology and politics, ecolog ...

, and that they fight against

transnational corporations A multinational corporation (MNC; also called a multinational enterprise (MNE), transnational enterprise (TNE), transnational corporation (TNC), international corporation, or stateless corporation, is a corporate organization that owns and cont ...

and external intervention in Latin America, singling out

extractivism Extractivism is the removal of natural resources particularly for export with minimal processing. This economic model is common throughout the Global South and the Arctic region, but also happens in some sacrifice zones in the Global North in Eu ...

and the

armed forces A military, also known collectively as armed forces, is a heavily armed, highly organized force primarily intended for warfare. Militaries are typically authorized and maintained by a sovereign state, with their members identifiable by a ...

and the defense of

natural resource Natural resources are resources that are drawn from nature and used with few modifications. This includes the sources of valued characteristics such as commercial and industrial use, aesthetic value, scientific interest, and cultural value. ...

s and native communities. The group said they wanted to expose companies and governments, "so that everyone knows their way of operating, their actions, their profits and the interest that is clearly to profit no matter the damage they cause." Guacamaya told Motherboard in an email. "These hacks are another form of struggle and resistance, they are the continuation of an ancestral legacy; taking care of life. We hope to cause more people to join, to leak, sabotage, and hack these sources of oppression and injustice, so that the truth be known and that it is the people who decide to end it." They told Cyberscoop that they target "anything that represents oppressive states, multinational corporations and, in short, anything that supports this system of death."

Hacks

Attacks on transnational companies

In 2022, the group said they were responsible for a series of cyberattacks aimed at large mining companies in Latin America, including the Colombian oil company New Granada Energy Corporation, the

Brazil Brazil, officially the Federative Republic of Brazil, is the largest country in South America. It is the world's List of countries and dependencies by area, fifth-largest country by area and the List of countries and dependencies by population ...

ian mining company Tejucana, the

Venezuela Venezuela, officially the Bolivarian Republic of Venezuela, is a country on the northern coast of South America, consisting of a continental landmass and many Federal Dependencies of Venezuela, islands and islets in the Caribbean Sea. It com ...

n oil company Oryx Resources, the

Ecuador Ecuador, officially the Republic of Ecuador, is a country in northwestern South America, bordered by Colombia on the north, Peru on the east and south, and the Pacific Ocean on the west. It also includes the Galápagos Province which contain ...

ian state-owned mining company ENAMI EP, and the Chilean

boric acid Boric acid, more specifically orthoboric acid, is a compound of boron, oxygen, and hydrogen with formula . It may also be called hydrogen orthoborate, trihydroxidoboron or boracic acid. It is usually encountered as colorless crystals or a white ...

producer Quiborax.

2022 Guatemalan Nickel Company Hack

In March 2022, Guacamaya first became known by hacking the mining company Compañía Guatemalteca de Níquel (CGN), a subsidiary of Solway Investment Group. The leaked documents reveal payments to Guatemalan Police who persecuted and detained activists and journalists who opposed the "Fénix" mining project in El Estor, Guatemala.

Operation Fuerzas Represivas

In mid-2022, the group announced Operation Fuerzas Represivas, a series of cyberattacks aimed at the armed forces of

, and

Hacking of the Joint Chiefs of Staff of Chile in 2022

In 2022, the Chilean press reported on the hacking of the Chilean Joint Chiefs of Staff (EMCO), a massive leak of national security data. The leak was made up of emails sent and received between 2012 and May 2022 by EMCO, the agency in charge of intelligence, operations and logistics for national defence purposes. General Guillermo Paiva Hernández, head of the country’s Joint Chiefs of Staff, resigned in response to the leak.

Hacking of Mexico's National Defense Ministry (SEDENA) in 2022

On September 29, 2022, Mexican journalist

Carlos Loret de Mola Carlos Loret de Mola Álvarez (born October 17, 1976 in Mérida, Yucatán) is a Mexican journalist. He currently hosts the radio program ''Así las cosas con Carlos Loret de Mola'' on W Radio and is a contributor to '' El Universal''. Most re ...

announced on his newscast that he had received six terabytes of hacked data from the Mexican Ministry of National Defense. The leak, which contains internal communications and documents from the army's email servers from 2010 to 2022, is considered the largest in the

history of Mexico The history of Mexico spans over three millennia, with the earliest evidence of hunter-gatherer settlement 13,000 years ago. Central and southern Mexico, known as Mesoamerica, saw the rise of complex civilizations that developed glyphic writing ...

. Citing privacy concerns, the Guacamaya group categorized the data set as limited distribution. Journalists and organizations seeking access must provide credentials and agree to reproduce the records responsibly. Known as the "SEDENA Leaks" or the "Guacamaya Leaks," the data set reveals the Mexican military's links to criminal organizations and the army's surveillance of opposition groups, politicians, journalists, and activists. Among the revelations, the leaks demonstrate widespread sexual abuse within the army and the targeting of feminists groups as subversive organizations that pose a threat equal to cartels. They also show the military's use of the

Pegasus Pegasus (; ) is a winged horse in Greek mythology, usually depicted as a white stallion. He was sired by Poseidon, in his role as horse-god, and foaled by the Gorgon Medusa. Pegasus was the brother of Chrysaor, both born from Medusa's blood w ...

spyware and its deployment against journalists, human rights activists, and government officials. The leak reveals new details of the army's role in the Ayotzinapa case where forty-three students were forcibly

disappeared An enforced disappearance (or forced disappearance) is the secret abduction or imprisonment of a person with the support or acquiescence of a state followed by a refusal to acknowledge the person's fate or whereabouts with the intent of placing ...

. Information on the health of President

Andrés Manuel López Obrador Andrés Manuel López Obrador (; born 13 November 1953), also known by his initials AMLO, is a Mexican former politician, political scientist, public administrator and writer who served as the 65th president of Mexico from 2018 to 2024. He se ...

, army contracts for the construction of the Mayan train, and the military's development of a tourist business, including parks, a national airline, museums, and hotels are also included in the leaked data. The Mexican government's response to the hack has attempted to minimize and even deny the revelations. López Obrador, whose presidential campaign promised to end state surveillance of private citizens, continues to insist that his administration "does not spy."

Hacking of the Joint Command of the Armed Forces of Peru in 2022

In October 2022, a report in ''La Encerrona'' revealed a massive leak of military intelligence data

Joint Command of the Armed Forces of Peru The Joint Command of the Armed Forces of Peru (CCFFAA) () is the executive agency of the Ministry of Defence (Peru), Ministry of Defence of Peru in charge of the Military of Peru, Armed Forces. The current Chief of the Joint Command (Peru), Presid ...

(CCFFAA). The report gave special focus to the Southern Operational Command of the Army. The leaks revealed the military was monitoring reporters, left-wing parties and figures, and that they labeled civil organizations as a threat because they "infiltrate and advise the population against mining." The Peruvian military threatened to bring treason charges against a journalist with the independent Peruvian news outlet La Encerrona for reporting on the leak.

NarcoFiles

In November 2023, the

Organized Crime and Corruption Reporting Project The Organized Crime and Corruption Reporting Project (OCCRP) is a global network of Investigative journalism, investigative journalists. It was founded in 2006 and specializes in organized crime and corruption. It publishes its stories through ...

joined with more than 40 media partners including Cerosetenta / 070, Vorágine, the Centro Latinoamericano de Investigación Periodística (CLIP) and

and journalists in 23 countries and territories for the largest investigative project on organized crime to originate in Latin America, producing the ' NarcoFiles' report. The investigation was based on more than seven million emails from the Colombian prosecutor’s office which had been hacked by Guacamaya, including correspondence with embassies and authorities around the world. The files dated from 2001-2022 and included audio clips, PDFs, spreadsheets, and calendars. The investigation revealed new details about the global drug trade and over 44 tons of "controlled deliveries" carried out to infiltrate the drug trade and how criminals corrupt politicians, bankers, accountants, lawyers, law enforcement agents, hackers, logistics experts, and journalists in order to use logistical, financial, and digital infrastructures.

References

{{Hacking in the 2020s, state=autocollapse Hacker groups Hacking in the 2020s Hacktivists Internet leaks Latin America News leaks Transparency (behavior)