Cyber Threat Actor: Team Cyber Criminals

The threat actor known as Team Cyber Criminals and CyberTeam operates with publicly claimed ties to Pakistan. This group has conducted cyber operations targeting both governmental and corporate entities across multiple regions, including Angola, Paraguay, and Guatemala. Their activities primarily involve website defacements and disruptive attacks, often accompanied by public claims via social media to amplify visibility.

CyberTeam's targeting spans government institutions—such as Angola’s National Assembly, Paraguay’s public information portal, and judicial or electoral bodies—as well as corporate sectors, notably automotive distributors in Guatemala. Strategic objectives center on disruption and publicity rather than financial gain or data theft, as evidenced by their defacement of Toyota, Renault, and Chevrolet Guatemala sites in 2014 and their declaration of hacking Angola’s parliament "just for fun" in 2025. The actor leverages web vulnerabilities, particularly exploiting insecure content management systems or shared infrastructure, as seen in the Guatemala incident where multiple auto sites developed by the same company were compromised. While no specific malware families are documented, their operations emphasize opportunistic attacks against low-hanging vulnerabilities. CyberTeam has loosely affiliated itself with a self-proclaimed "Cyber Army of the Community of Portuguese Language Countries," though no formal criminal or state nexus is publicly confirmed. Notable campaigns include the 2025 breach of Angola’s parliamentary website, part of a broader pattern targeting Lusophone nations, and the 2014 Guatemala defacements highlighting persistent weaknesses in third-party web services. Authorities in affected countries have consistently downplayed data exposure risks, though the repeated disruptions underscore the group’s focus on undermining institutional credibility through overt, if technically rudimentary, intrusions.