NyxarGroup

NyxarGroup is a data-theft and leak-oriented threat actor associated with claimed intrusions into Latin American government systems, particularly in Colombia and Chile. The actor has been observed advertising or releasing allegedly stolen government data on public forums, including datasets tied to public-sector workforce systems, transparency and lobbying records, and regional government extranet services. Reported collaborators include ArcRaidersPlayer, Petro_Escobar, CryptoDead, and an alias identified as PescobarLegado in at least one operation. Activity attributed to NyxarGroup has centered on unauthorized access to public-facing government platforms and the extraction of structured records from information repositories. Reported victim organizations include Colombian regional and municipal government entities and Chilean government services. Claimed compromises have involved employee directories, personnel records, public-servant training platform data, and government transparency records, including information related to meetings and official roles. The actor has repeatedly monetized access by offering datasets for sale and has also published stolen records freely, indicating both financial and exposure-driven leak behavior. Observed tradecraft includes exploitation of public-facing applications, collection from information repositories, gathering of employee identity information, archiving of collected data, exfiltration over web services, and post-compromise publication or sale of stolen data. The available reporting supports exfiltration and post-exploitation data handling, but does not provide high-confidence evidence for ransomware deployment, encryption, disruptive attacks, or destructive operations. NyxarGroup appears primarily focused on government-sector data theft and exposure in Latin America rather than network disruption or conventional espionage persistence operations.