The purpose of this publication is to provide updated information on the primary initial access methods most commonly used by cybercriminals, based on observed telemetry from ransomware attacks targeting organizations in Latin America during the first half of 2026.<\/p>\n\n\n\n
Threat actors seek and exploit vulnerabilities in outdated or unpatched software, particularly in applications or infrastructure exposed to the Internet.<\/p>\n\n\n\n
Using weak or reused passwords, attackers can execute brute force attacks to gain access to valid user accounts. Likewise, credentials stolen from data breaches allow them to legitimately access corporate systems.<\/p>\n\n\n\n
\u2022 How does it work? Attackers use automation tools to generate multiple username and password combinations until they find a valid one. They may also use credentials stolen from previous breaches or through infostealers, data leaks, password reuse, session hijacking, or purchasing access in underground markets. Once they have a legitimate account, they attempt to access various services without the need to exploit additional vulnerabilities. The recent trend also includes the hijacking of authenticated sessions and manipulation of MFA<\/a> mechanisms.<\/p>\n\n\n\n As organizations strengthen traditional security controls, ransomware operators increasingly resort to techniques that seek to abuse user trust rather than exploit technical vulnerabilities. This trend prioritizes the theft of valid identities and sessions to access corporate environments using apparently legitimate mechanisms.<\/p>\n\n\n\n Infostealers are a class of malware designed to steal confidential information, such as passwords, session cookies<\/a>, financial data, and other personal data stored on infected devices (especially in web browsers). Additionally, they are leveraged by threat actors to download and execute other threats, including ransomware. A growth in ClickFix-type<\/a><\/em> campaigns has also been observed, where victims are deceived into manually executing malicious commands under the pretext of resolving a supposed technical error, completing a CAPTCHA<\/a>, updating an application, or verifying their identity.<\/p>\n\n\n\n Initial access brokers are specialized actors that compromise organizations to subsequently sell the obtained access to other criminal groups, including ransomware and extortion operators. This has given rise to a criminal economy where initial access is commercialized as a service.<\/p>\n\n\n\n Attackers exploit weak configurations or vulnerabilities in VPN, Citrix, and RDP (Remote Desktop Protocol) services to gain unauthorized access to internal networks and sensitive data.<\/p>\n\n\n\n Pirated software refers to legitimate software that has been intentionally modified to evade license verification systems. This type of software typically includes backdoors or malware and is distributed through unofficial channels or low-trust domains. Attackers employ malvertising through malicious ads on legitimate web search engines, which redirect users to infected pages that automatically download malware without it being evident.<\/p>\n\n\n\n Black Hat SEO<\/em>, also known as BlackSEO<\/em>, is a practice that enables better positioning of a website in online search engine results. Through algorithms and techniques such as keyword repetition within site content, attackers alter the organic positioning of web search engines, allowing their malicious sites to be listed in the top positions to increase their probability of being selected and compromising their victim.<\/p>\n\n\n\n Attackers send emails that appear legitimate to deceive victims into clicking on malicious links or downloading infected attachments. To increase their effectiveness, these emails may be highly personalized, employing spear-phishing techniques targeting specific individuals within an organization.<\/p>\n\n\n\n \u2022 How does it work? Attackers send emails that impersonate legitimate organizations. These emails appear to come from trusted sources but contain malicious links, infected attachments, or even QR codes in images or with ASCII characters that evade email filtering devices. The objective is to deceive victims or direct specific campaigns against executives to obtain credentials or induce malware downloads.<\/p>\n\n\n\n \u2022 Why does it happen? These techniques leverage social engineering, manipulating people’s emotions and trust. Attackers can personalize emails based on information gathered about the victim, which increases the probability of success.<\/p>\n\n\n\n Attackers seek vulnerabilities<\/a> in AI platforms, corporate assistants, extensions, connectors, retrieval systems, or services that interact with enterprise information.<\/p>\n\n\n\n Attackers compromise software providers, managed services, technology integrators, or third parties with privileged access to multiple clients to insert malware into legitimate software updates, affecting multiple organizations simultaneously. This type of attack is particularly dangerous because it can be introduced into internal systems through a trusted channel.<\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" The purpose of this publication is to provide updated information on the primary initial access methods most commonly used by<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-1610","post","type-post","status-publish","format-standard","hentry","category-ransomware"],"_links":{"self":[{"href":"https:\/\/blog.scilabs.mx\/en\/wp-json\/wp\/v2\/posts\/1610","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.scilabs.mx\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.scilabs.mx\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.scilabs.mx\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.scilabs.mx\/en\/wp-json\/wp\/v2\/comments?post=1610"}],"version-history":[{"count":1,"href":"https:\/\/blog.scilabs.mx\/en\/wp-json\/wp\/v2\/posts\/1610\/revisions"}],"predecessor-version":[{"id":1612,"href":"https:\/\/blog.scilabs.mx\/en\/wp-json\/wp\/v2\/posts\/1610\/revisions\/1612"}],"wp:attachment":[{"href":"https:\/\/blog.scilabs.mx\/en\/wp-json\/wp\/v2\/media?parent=1610"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.scilabs.mx\/en\/wp-json\/wp\/v2\/categories?post=1610"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.scilabs.mx\/en\/wp-json\/wp\/v2\/tags?post=1610"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
\n
Theft and Access Through Legitimate Identities<\/a><\/strong><\/h2>\n\n\n\n
\n
\n
Infostealers<\/a><\/strong><\/h2>\n\n\n\n
\n
\n
Initial Access Brokers<\/a><\/strong><\/h2>\n\n\n\n
\n
\n
Access Through Remote Services Such as VPN<\/a>, Citrix<\/a>, and RDP<\/a> with Weak Security Configuration<\/strong><\/h2>\n\n\n\n
\n
\n
Pirated Software<\/a>, Malvertising<\/a>, and Black Hat SEO<\/a>:<\/strong><\/h2>\n\n\n\n
\n
\n
Phishing<\/a> and Spear-Phishing Emails<\/a><\/strong><\/h2>\n\n\n\n
Exploitation of Vulnerabilities in AI Services and Agents<\/a><\/strong><\/h2>\n\n\n\n
\n
\n
Supply Chain Attacks<\/a><\/strong><\/h2>\n\n\n\n
\n
\n