Guatemala was the target of a cyber attack against the Ministry of Foreign Affairs (MINEX), as confirmed by the United States Embassy in the country, and although the authorities did not say it directly, USA. UU. Links the case with a Chinese -based espionage network.
A joint review between Guatemala and the South Command of the US Army identified in government systems a Advanced persistent threat (APT, in English)specifically APT-15also known as Vixen Panda, Nickel either Nylon Typhoon.
This group has been associated by international agencies to cyberspage campaigns against Foreign Ministries in Central America and South America. The attack on Minex would not be an isolated case.
Although cyber attack occurred in 2022the case He resurfaced after a publication of the United States Embassy in Guatemala, on April 29, 2025.
A joint cybersecurity review between @Guatemalagob and @Southcomidentified that the entire computer system of the @Minexgt He was hacked by cyber spying groups based in the People’s Republic of China. Through this collaboration effort, USA reaffirms … pic.twitter.com/4ehtyeej5q
– Us Embassy Guatemala (@usembassyguate) April 29, 2025
What is APT-15 and what could be your reach?
APT-15 is a cyberspage group linked by several countries to the interests of the Chinese state.
APT15, also known as Nylon Typhoon, is a cyberspage group linked to China that represents a threat to key sectors such as trade, finance and defense, according to Microsoft and Hedge Hog
From the end of 2022 to the beginning of 2023 carried out an intrusion campaign mainly directed to Foreign Ministries of Latin America.
His goal was Extract internal documents, diplomatic intelligence data and access institutional accountsaccording to a publication of Security.com of mid -2023.
APT-15 not only steals data, but Adapt your techniques to each country and maintains presence in networks violated for monthswhich raises a Strategic threatas described specialized sites.
Operates with a strategy stealthy and long termsearching remain as long as possible within government networks without being detected.
To achieve this, use tools such as a Malicious program called “Graphican”that takes advantage of legitimate platforms such as Microsoft Graph and OneDrive, simulating normal system use To evade security controls.
Possible scope of intrusion
Although neither Guatemala nor USA. They specified when the intrusion occurred, in October 2022 The Minex publicly admitted a cyber attack that he left Inoperative several of its digital services.
At the time, these were the confirmed actions In the MINEX, according to publications of Free press and the site Bloomberg :
- Digital Services Interruption: The attack caused the Temporary suspension of several online services of the Minex, affecting the attention to Guatemalans abroad.
- Apparent data subtraction: The group Onyxattributed to the attack in 2022, said downloaded 3.7 terabytes of Minex information in a period of four weeks.
- Filtration of sensitive documents: The attacking group He published subtracted information of MINEX servers, including Apostillas issued in consulates between 2021 and 2022with Personal data as names, surnames, signatures and codes QR. Documents related to candidacies to international organizations and Consular assistance to deprived of liberty.
- Additional information commitment: The exhibition of more than 52 documents containing information about Temporary Guatemalans in the United States, hospitalized, deprived of liberty and listings of unaccompanied minors in 2021. Data on repatrices, accounting issues, lists of lawyers, newsletters and statistics.
The Minex reserved all the official information About cyber attack at that time, without revealing technical details or confirming the actors behind the intrusion.
Is Guatemala in that list of objectives?
The New American evaluation suggests that APT-15 would have been present in the networks of the Guatemalan government as part of a Regional campaign.
This does not mean that Onix and APT-15 are the same groupbut the Minex computer system would have been violated “By cyber spying groups based in the People’s Republic of China”according to the United States.
The mention of APT-15 by the South Command and the United States Department of Defense It does not explicitly refer to a prolonged operation, but Yes it allows to contextualize the hacking.
In his statement, the US authorities indicated that The presence of an advanced persistent threat (APT) was identifiedknown as APT-15 “Also called.” Vixen Panda, Nickel or Nylon Typhoon-, associated with China and linked to intrusions in government organizations globallywith emphasis on Central America and South America countries.