CartelCorp x BLACKNET-00 Turn Government Correspondence into a Pressure Tool in Paraguay and Mexico

Executive Summary

The ransomware alliance between CartelCorp and BLACKNET-00 — with BLACKNET-00 reportedly developed by the group Infrastructure Destruction Squad — claimed to have compromised email systems belonging to two Latin American public-sector organizations: Paraguay’s National Service for Plant and Seed Quality and Health (SENAVE) and the Mexican Geological Survey (SGM).

In both cases, the actors claim to have gained control over institutional systems, extracted complete archives, and deleted information. They also threaten to release additional documentation if their financial demands are not met.

The screenshots released alongside the claims support a narrower conclusion: the alliance possesses material that appears consistent with institutional email and documentation from both organizations.

Government Correspondence as an Extortion Asset

CartelCorp x BLACKNET-00 claims to gain access to government systems, extract correspondence and internal documents, and subsequently use that material as leverage.

The central threat is therefore not limited to disrupting services, but extends to turning institutional information into an asset that can be publicly exposed.

Although the alliance explicitly uses the label “Ransomware Alliance”, the behavior displayed in these operations more closely follows a model of access, exfiltration, and coercion through document exposure.

Paraguay: Recent SENAVE Material Consistent with Institutional Activity

In Paraguay, the images show a Zimbra email session associated with accounts under the institutional senave.gov.py domain, with visible messages dated 2026.

The material also includes documents related to inspections, transportation of phytosanitary products, seeds, administrative proceedings, and communications involving the Public Prosecutor’s Office.

This type of content is consistent with SENAVE’s official responsibilities, which include regulating and supervising seeds, plant products, and agrochemicals, as well as overseeing importer registries and different sanitary and phytosanitary control processes.

The visible correspondence therefore strengthens the plausibility that the actor possesses material associated with the institutional environment. The alliance presents those documents as evidence of government corruption, commercial manipulation, and smuggling networks.

Mexico: Institutional Evidence, but with a Different Temporal Dimension

The screenshots attributed to the Mexican Geological Survey likewise show an institutional email environment and accounts belonging to the sgm.gob.mx domain.

SGM is a decentralized public agency linked to Mexico’s Ministry of Economy whose responsibilities include producing national geological information and carrying out activities related to mineral resources and geological-mining services.

In this case, however, there is an important difference from Paraguay: a substantial portion of the visible correspondence dates back to 2018.

The screenshots reasonably support the assessment that the actors possess historical content apparently associated with SGM institutional accounts, but they do not demonstrate that the alliance currently controls the organization’s entire email infrastructure. Nor do they prove the claim that the complete archive was extracted and subsequently deleted.

The age of the material also introduces several possibilities that the available evidence cannot yet distinguish: recent access to a historical mailbox, prior acquisition of the material, reuse of an older collection, or compromise of a platform that retained historical correspondence.

Analytical Closing

The two announcements provide a useful signal for characterizing the alliance’s activity.

In both cases, CartelCorp x BLACKNET-00 uses internal documents as evidence of access while withholding the remaining information as leverage for negotiation.

The declared pattern can be summarized as:

access → correspondence extraction → document selection → threat of publication → demand for payment.

The possible deletion of systems would add a destructive dimension, but that element currently remains supported primarily by the actors’ own claims.

Beyond that uncertainty, what can be observed is that government correspondence acquires value not only because of its confidentiality, but also because it can be used to construct narratives of corruption, irregularities, or mismanagement capable of increasing reputational pressure on the victim.