Mexico, main target in Macaw leaks in Latin America

Mexico, immersed in a debate about the growing power of the military, is the country hardest hit by leaks from the Guacamaya hacking network, which has released confidential documents from several Latin American countries.

The controversy over the enormous accumulation of power of the Armed Forces in the presidency of the leftist Andrés Manuel López Obrador was accentuated after the revelations shared by this group, which also affect other countries such as Chile, Peru, Colombia.

In Latin America everyone knows the chatty macaws, but nobody knows much about these anonymous hackers who share hacked files upon request to the email Enlacehactivista@riseup.net, explain two Mexican journalists.

They are “hacker-activists,” estimates Diego Macor, a cybersecurity expert at IBM in Chile. “What they are looking for is a more political end than an economic end,” he says.

The Spanish newspaper El País assures that it has had access to “more than four million” files that, among other things, allowed verifying the existence of the contract between the Mexican Army and the Israeli firm NSO to buy the controversial Pegasus espionage program.

With Pegasus, the phones of at least one activist and two journalists were infiltrated, adds El País, which cites the research laboratory of the University of Toronto, Citizen Lab.

The Mexican Army argued in a statement on October 4 that Pegasus was used only in “operations against organized crime.”

Asylum in Assange

The “improper monitoring” of civil society organizations by the Army in Mexico and Peru revealed by the so-called “Guacamaya-leak” reveals “the deterioration of respect for human rights,” denounced Amnesty International, which denounced having been spied on.

In Mexico, leaks have shown that the Army was the promoter of a reform voted in September to put the National Guard, created in 2019, under the command of Defense, says the weekly Proceso.

The “Guacamaya-leak” broke out on September 30 with unpublished information about the health of President Andrés Manuel López Obrador, such as when the 68-year-old president had to be rushed from his ranch in Chiapas (south) to a military hospital in the capital on January 2 due to a heart problem.

“There was a cyber attack, a theft of information,” the president acknowledged on September 30, when he also confirmed the versions about his health.

Mexican deputies have called Defense Secretary Luis Cresencio Sandoval to appear before the legislature to explain this scandal, but the official has only agreed to receive them in his office.

And with Guacamaya in the background, last Wednesday night a constitutional reform was voted that extends the participation of the military in security tasks from 2024 to 2028, which earned López Obrador accusations of seeking to “militarize” the country by opponents. .

With an ironic touch: Mexico, the most affected by “Guacamaya-leak”, has offered asylum to… Julian Assange, the founder of Wikileaks.

Colombia and Chile too

In Colombia, the group claims to have hacked more than 300,000 private emails from the General Command of the Armed Forces and the prosecutor’s office.

The announcement was made on the Distributed Denial of Secrets platform. And it also shares its information upon request by email.

The Colombian Armed Forces only admitted that they are “aware of the possible extraction of information from the General Command,” according to a statement.

On August 1, Guacamaya revealed tens of thousands of emails from the state-owned Agencia Nacional de Hidrocarburos and the private company New Granada Energy Corporation.

This leak accounts for at least 62 spills of crude oil and other chemicals in the company’s wells between 2015 and 2020.

Most of these “environmental incidents” were not reported to authorities, according to internal communications from New Granada Energy Corporation.

In Chile, this network of hackers hacked the servers of the joint command of the Armed Forces, according to three experts consulted by AFP.

“The “hacking” was achieved through a vulnerability that affects Microsoft’s Exchange servers,” explains Nicolas Boettcher, from the Diego Portales University School of Computer Science and Telecommunications.

This failure was known since August 2021, he adds, but “the public tender was not held to tender the review and repair of the servers.”