Cyber Threat Actor: Uruguayo1337

Uruguayo1337 is an alias used by a threat actor whose known location is Uruguay. The actor first came to public attention through a website defacement incident reported in March 2025. No other aliases or affiliations have been publicly attributed to this actor in open sources. The incident was reported by Subrayado, a Uruguayan news outlet that provided details of the defacement and the accompanying message.

On March 17 2025 the actor defaced the website of the Dirección Nacional de Aviación Civil e Infraestructura Aeronáutica, replacing its content with a photograph of President Yamandú Orsi alongside his mobile phone number. The defacement included a statement claiming that the actor had obtained access to all addresses, SGSP police records, secrets and dossiers of politicians and public officials. The message was signed with the tags LaPampaLeaks, BogotaLeaks and Uruguayo1337. In the statement the actor denounced progressivism, political corruption and mafias, and also featured an image of an Agesic director. The actor asserted that those responsible would be made to pay for their actions against Uruguay. The defacement was carried out in conjunction with the anniversary ceremony of the Uruguayan Air Force, an event that President Orsi was scheduled to attend. The claim of access to sensitive data has not been publicly corroborated.

No further public reports link Uruguayo1337 to additional campaigns, malware families, specific initial access vectors, or particular tooling beyond the website defacement described. The actor’s activity to date is limited to this single disclosed operation, which combined a political message with a claim of data access. No indication of financial gain has been associated with this activity. As a result, any assessment of broader targeting patterns, strategic objectives, or affiliations remains unsupported by available evidence.