A private, community-driven cybersecurity initiative for Guatemala.
Guatemala’s threat landscape: ransomware, exploited vulnerabilities, malware and global context, with a plain-language explanation of every chart.
The aggregates on this page and the indicators of compromise can be queried programmatically, as JSON, under the CC BY 4.0 license. For direct access, request an API key; we review it and send it to you by email.
curl -H "Authorization: Bearer YOUR_KEY" \ "https://cert.gt/api/estadisticas"
The indicators and their trend over time can also be explored under Indicators. The monthly PDF report and the regional comparison will follow once we have enough data of our own.
23
Guatemalan organizations posted on leak sites
Sep 3, 2026
most recent posting
| Year | Victims |
|---|---|
| 2022 | 1 |
| 2023 | 6 |
| 2024 | 4 |
| 2025 | 7 |
| 2026 | 5 |
What am I looking at?
How many organizations based in Guatemala have been named by criminal groups on the sites where they display their victims to pressure them into paying a ransom.
This is a floor, not the total: it leaves out those who paid without ever being posted and the cases that never came to light. Nor does an organization’s appearance confirm, on its own, that its data was leaked. Sectors are classified by the source.
Source: ransomware.live (only victims the groups made public) · updated Nov 1, 09:19 PM
1,766
vulnerabilities in the known exploited catalog
| Month | Vulnerabilities |
|---|---|
| Dec 25 | 20 |
| Jan 26 | 17 |
| Feb 26 | 28 |
| Mar 26 | 26 |
| Apr 26 | 31 |
| May 26 | 21 |
| Jun 26 | 23 |
| Jul 26 | 26 |
| Aug 26 | 31 |
| Sep 26 | 43 |
| Oct 26 | 36 |
| Nov 26 | 0 |
What am I looking at?
How many security flaws were confirmed, each month, to be in use by attackers in real attacks around the world.
These are not flaws discovered that month, nor are they specific to Guatemala: they affect any organization running those products without updating them. A high month means more urgent patching work for technology teams.
Source: CISA KEV · updated Nov 1, 09:19 PM
No data.
What am I looking at?
The internet services that receive the most unsolicited connection attempts worldwide, according to an international network of volunteer sensors. A port is the “door” through which a service is reached: 80 and 443 are websites, 22 is remote administration, and 23 is common on cameras and routers.
It serves as a point of comparison: it measures the whole world, not Guatemala.
Source: SANS ISC / DShield (records from 2026-11-02, worldwide) · updated Nov 1, 09:19 PM
2,162
new IOCs in 24 h (ThreatFox, global)
0
recent indicators on .gt domains
What am I looking at?
An indicator is a technical fingerprint of a malicious program: an address or a file that researchers around the world reported in the last 24 hours. The list shows the malware families reported most often worldwide.
The second number counts how many of those fingerprints sit on sites with a .gt domain, which are usually legitimate sites that someone compromised to use without the owner knowing.
Source: abuse.ch · updated Nov 1, 08:40 PM
| Time | Index (0–1000) |
|---|---|
| Oct 25, 08:00 PM | 687 |
| Oct 25, 09:00 PM | 731 |
| Oct 25, 10:00 PM | 730 |
| Oct 25, 11:00 PM | 701 |
| Oct 26, 12:00 AM | 513 |
| Oct 26, 01:00 AM | 320 |
| Oct 26, 02:00 AM | 205 |
| Oct 26, 03:00 AM | 142 |
| Oct 26, 04:00 AM | 134 |
| Oct 26, 05:00 AM | 160 |
| Oct 26, 06:00 AM | 279 |
| Oct 26, 07:00 AM | 404 |
| Oct 26, 08:00 AM | 524 |
| Oct 26, 09:00 AM | 545 |
| Oct 26, 10:00 AM | 562 |
| Oct 26, 11:00 AM | 611 |
| Oct 26, 12:00 PM | 638 |
| Oct 26, 01:00 PM | 652 |
| Oct 26, 02:00 PM | 681 |
| Oct 26, 03:00 PM | 678 |
| Oct 26, 04:00 PM | 679 |
| Oct 26, 05:00 PM | 667 |
| Oct 26, 06:00 PM | 683 |
| Oct 26, 07:00 PM | 678 |
| Oct 26, 08:00 PM | 722 |
| Oct 26, 09:00 PM | 782 |
| Oct 26, 10:00 PM | 836 |
| Oct 26, 11:00 PM | 727 |
| Oct 27, 12:00 AM | 494 |
| Oct 27, 01:00 AM | 312 |
| Oct 27, 02:00 AM | 211 |
| Oct 27, 03:00 AM | 160 |
| Oct 27, 04:00 AM | 155 |
| Oct 27, 05:00 AM | 187 |
| Oct 27, 06:00 AM | 276 |
| Oct 27, 07:00 AM | 398 |
| Oct 27, 08:00 AM | 511 |
| Oct 27, 09:00 AM | 535 |
| Oct 27, 10:00 AM | 574 |
| Oct 27, 11:00 AM | 634 |
| Oct 27, 12:00 PM | 625 |
| Oct 27, 01:00 PM | 619 |
| Oct 27, 02:00 PM | 641 |
| Oct 27, 03:00 PM | 690 |
| Oct 27, 04:00 PM | 691 |
| Oct 27, 05:00 PM | 681 |
| Oct 27, 06:00 PM | 692 |
| Oct 27, 07:00 PM | 739 |
| Oct 27, 08:00 PM | 791 |
| Oct 27, 09:00 PM | 838 |
| Oct 27, 10:00 PM | 922 |
| Oct 27, 11:00 PM | 768 |
| Oct 28, 12:00 AM | 603 |
| Oct 28, 01:00 AM | 353 |
| Oct 28, 02:00 AM | 229 |
| Oct 28, 03:00 AM | 158 |
| Oct 28, 04:00 AM | 151 |
| Oct 28, 05:00 AM | 189 |
| Oct 28, 06:00 AM | 277 |
| Oct 28, 07:00 AM | 379 |
| Oct 28, 08:00 AM | 483 |
| Oct 28, 09:00 AM | 529 |
| Oct 28, 10:00 AM | 587 |
| Oct 28, 11:00 AM | 611 |
| Oct 28, 12:00 PM | 595 |
| Oct 28, 01:00 PM | 607 |
| Oct 28, 02:00 PM | 628 |
| Oct 28, 03:00 PM | 685 |
| Oct 28, 04:00 PM | 677 |
| Oct 28, 05:00 PM | 667 |
| Oct 28, 06:00 PM | 706 |
| Oct 28, 07:00 PM | 718 |
| Oct 28, 08:00 PM | 801 |
| Oct 28, 09:00 PM | 917 |
| Oct 28, 10:00 PM | 1,000 |
| Oct 28, 11:00 PM | 967 |
| Oct 29, 12:00 AM | 830 |
| Oct 29, 01:00 AM | 570 |
| Oct 29, 02:00 AM | 364 |
| Oct 29, 03:00 AM | 266 |
| Oct 29, 04:00 AM | 225 |
| Oct 29, 05:00 AM | 255 |
| Oct 29, 06:00 AM | 371 |
| Oct 29, 07:00 AM | 423 |
| Oct 29, 08:00 AM | 527 |
| Oct 29, 09:00 AM | 444 |
| Oct 29, 10:00 AM | 429 |
| Oct 29, 11:00 AM | 450 |
| Oct 29, 12:00 PM | 479 |
| Oct 29, 01:00 PM | 467 |
| Oct 29, 02:00 PM | 494 |
| Oct 29, 03:00 PM | 513 |
| Oct 29, 04:00 PM | 515 |
| Oct 29, 05:00 PM | 496 |
| Oct 29, 06:00 PM | 518 |
| Oct 29, 07:00 PM | 537 |
| Oct 29, 08:00 PM | 566 |
| Oct 29, 09:00 PM | 606 |
| Oct 29, 10:00 PM | 664 |
| Oct 29, 11:00 PM | 643 |
| Oct 30, 12:00 AM | 505 |
| Oct 30, 01:00 AM | 361 |
| Oct 30, 02:00 AM | 242 |
| Oct 30, 03:00 AM | 178 |
| Oct 30, 04:00 AM | 141 |
| Oct 30, 05:00 AM | 178 |
| Oct 30, 06:00 AM | 248 |
| Oct 30, 07:00 AM | 306 |
| Oct 30, 08:00 AM | 389 |
| Oct 30, 09:00 AM | 401 |
| Oct 30, 10:00 AM | 412 |
| Oct 30, 11:00 AM | 436 |
| Oct 30, 12:00 PM | 427 |
| Oct 30, 01:00 PM | 437 |
| Oct 30, 02:00 PM | 453 |
| Oct 30, 03:00 PM | 448 |
| Oct 30, 04:00 PM | 476 |
| Oct 30, 05:00 PM | 465 |
| Oct 30, 06:00 PM | 493 |
| Oct 30, 07:00 PM | 509 |
| Oct 30, 08:00 PM | 505 |
| Oct 30, 09:00 PM | 530 |
| Oct 30, 10:00 PM | 574 |
| Oct 30, 11:00 PM | 560 |
| Oct 31, 12:00 AM | 452 |
| Oct 31, 01:00 AM | 326 |
| Oct 31, 02:00 AM | 221 |
| Oct 31, 03:00 AM | 155 |
| Oct 31, 04:00 AM | 127 |
| Oct 31, 05:00 AM | 163 |
| Oct 31, 06:00 AM | 233 |
| Oct 31, 07:00 AM | 291 |
| Oct 31, 08:00 AM | 326 |
| Oct 31, 09:00 AM | 363 |
| Oct 31, 10:00 AM | 377 |
| Oct 31, 11:00 AM | 392 |
| Oct 31, 12:00 PM | 385 |
| Oct 31, 01:00 PM | 393 |
| Oct 31, 02:00 PM | 451 |
| Oct 31, 03:00 PM | 454 |
| Oct 31, 04:00 PM | 448 |
| Oct 31, 05:00 PM | 430 |
| Oct 31, 06:00 PM | 423 |
| Oct 31, 07:00 PM | 438 |
| Oct 31, 08:00 PM | 450 |
| Oct 31, 09:00 PM | 481 |
| Oct 31, 10:00 PM | 505 |
| Oct 31, 11:00 PM | 501 |
| Nov 1, 12:00 AM | 435 |
| Nov 1, 01:00 AM | 325 |
| Nov 1, 02:00 AM | 221 |
| Nov 1, 03:00 AM | 147 |
| Nov 1, 04:00 AM | 118 |
| Nov 1, 05:00 AM | 134 |
| Nov 1, 06:00 AM | 179 |
| Nov 1, 07:00 AM | 243 |
| Nov 1, 08:00 AM | 299 |
| Nov 1, 09:00 AM | 332 |
| Nov 1, 10:00 AM | 362 |
| Nov 1, 11:00 AM | 368 |
| Nov 1, 12:00 PM | 374 |
| Nov 1, 01:00 PM | 381 |
| Nov 1, 02:00 PM | 393 |
| Nov 1, 03:00 PM | 381 |
| Nov 1, 04:00 PM | 416 |
| Nov 1, 05:00 PM | 412 |
| Nov 1, 06:00 PM | 424 |
What am I looking at?
Guatemala’s internet traffic volume, hour by hour over the past week, as seen by Cloudflare on its network. It is a relative index, not a number of users: the busiest hour of the week is worth 1,000.
Normally it rises during the day and drops in the early hours. A sharp fall outside that rhythm may point to a failure or a service outage.
Source: Cloudflare Radar · updated Nov 1, 08:40 PM
What am I looking at?
Reports published by security researchers that name Guatemala in their title, description or tags. Each one groups together the technical fingerprints of an attack campaign.
A mention of Guatemala does not mean the attack succeeded here; it means the country appears among the targets or in the context of the report.
Source: AlienVault OTX · updated Nov 1, 08:40 PM
7
reports received through the portal
What am I looking at?
The cases that individuals and organizations have reported directly to cert.gt through its form.
It reflects what people choose to report, not everything that happens in the country. An increase may mean more incidents, or simply that more people know about the service.