Threat Actor Characterization
CiberinteligenciaSV
ID: 7c6fdbeb0c4000a8064f5b96205e7b7499732| CERTAINTELLIGENCE SV | Ciber Inteligencia SV | Ci***** | Gu******** |
| Gu********** | — | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
CiberinteligenciaSV is a Salvadoran breach-and-leak cluster focused on public exposure of government-linked and citizen-linked datasets. The actor is strongly associated with national-scale data leaks, anti-government messaging, Telegram/X amplification, and publication on BreachForums rather than with publicly documented bespoke malware.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1213 | Data from Information Repositories | TA0009 |
|
| T1005 | Data from Local System | TA0009 |
|
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1567 | Exfiltration Over Web Service | TA0010 |
|
| T1589 | Gather Victim Identity Information | TA0043 |
|
CiberinteligenciaSV / GuacamayalSV
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE | Source grading in this section: predominantly B2–C3 OSINT; no HUMINT corroboration identified.
Category: Cybercrime / Politically charged data-leak and anti-government breach cluster — Origin: El Salvador
Author: iQBlack CTI Team
Executive Summary
CiberinteligenciaSV is best assessed as a Salvadoran breach-and-leak cluster rather than a conventional malware-centric intrusion set. Its public footprint centers on Telegram, X, and criminal forum publication, with repeated exposure of sensitive government and citizen data, especially during 2024. The group also operated under, or publicly promoted, the aliases “Guacamayal” and “GuacamayalSV,” but the supposed linkage to the original regional Guacamaya hacktivist collective remains unverified and is treated here as branding rather than confirmed organizational continuity.
Publicly attributed activity indicates a pattern of mass data leakage, selective publication of politically resonant records, public taunting of government institutions, and repeated promises to release databases “for free.” The cluster was publicly associated with the leak of more than five million Salvadoran records, the exposure of alleged Chivo Wallet source code and VPN access, disclosures tied to the Supreme Court’s electronic notifications environment, payroll and contractor-related leaks, and additional releases affecting Salvadoran state institutions.
