CiberInteligenciaSV is a threat actor targeting government entities in El Salvador.
CiberInteligenciaSV is a threat actor targeting El Salvador's government entities. They leaked 5.1 million citizen records on Breach Forums and compromised the state Bitcoin wallet Chivo, exfiltrating its source code and VPN credentials. Key TTPs include data leaking, credential theft, and false flag attribution by associating with the Guacamaya group. Defenders should monitor Breach Forums for exposed data, enforce multi-factor authentication on VPN access, and audit government systems for anomalies related to these breaches.
CiberInteligenciaSV is a threat actor that leaked 5.1 million Salvadoran records on Breach Forums. They have also compromised El Salvador's state Bitcoin wallet, Chivo, leaking its source code and VPN credentials. The group aims to obscure their involvement by associating with the Guacamaya group and its proxies.
Breach Forums.
The state Bitcoin wallet called Chivo.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.