Cyber Threat Actor: Uruguayo1337

The threat actor knownby the aliases Urugayoy1337 and Uruguayo1337 operates from Uruguay and has been observed conducting politically motivated cyber actions against governmental targets. The actor’s public presence is limited to a single documented incident in which they defected a government website and used the intrusion to broadcast a message tied to broader social and political grievances. No additional affiliations, sponsorships, or broader operational infrastructure have been publicly attributed to this actor.

In terms of targeting, the actor focuses on national government institutions within Uruguay, specifically targeting civil aviation authorities and associated presidential communications. The strategic objectives expressed in their communications include protesting perceived progressivism, denouncing political corruption and mafias, and asserting that those responsible for actions against Uruguay will be held accountable. The actor claimed access to sensitive data such as personal addresses, police records, and dossiers of politicians and public officials, using this claim as leverage to amplify their message. Their tactics, techniques, and procedures are limited to website defacement, the display of personal information and imagery, and the inclusion of signed tags such as LaPampaLeaks, BogotaLeaks and Uruguayo1337 to attribute the act. No malware families, exploit tools, or specific initial access vectors have been reported in connection with this activity.

The most notable publicly reported operation occurred on March 17 2025, when the actor defaced the website of the Dirección Nacional de Aviación Civil e Infraestructura Aeronáutica. The defacement featured a photograph of President Yamandú Orsi alongside his mobile phone number, a statement asserting access to extensive governmental data, and an image of an Agesic director. The message condemned political corruption and warned that those responsible would face consequences, coinciding with the anniversary ceremony of the Uruguayan Air Force that the president was scheduled to attend. This incident remains the sole documented campaign attributed to the actor, and no further operations or broader criminal or state‑linked associations have been verified in open sources.