Executive Summary

Q22 published a new claim stating that it affected resources linked to the Colombian government, including alleged satellite receivers and systems associated with broadcasting. According to the actor’s message, the activity allegedly targeted around 30 radio resources and 8 satellite receivers affiliated with the government environment in Colombia.

Based on the available information, there is no independent confirmation of the actual interruption scope of the receivers or of the alleged destruction of configurations. The screenshots and video accompanying the message as “evidence” provide visual support showing access to technical interfaces, but they do not actually prove that the impact declared by the actor was effective.

So far, Q22 has shown short, dispersed activity without a clearly consolidated political agenda. The direct reference to the Colombian government may indicate an early exploration of targets in Latin America or an opportunistic search for exposure through poorly protected technical resources.

Key Judgments

• Q22 claims to have affected broadcasting resources and satellite receivers associated with Colombia.
• The visual material shared by the actor shows technical interfaces compatible with GNSS/satellite equipment and management systems, but it does not confirm the declared impact by itself.
• The direct mention of the Colombian government introduces a geographically relevant signal for monitoring in Latin America.
• There is not enough evidence to confirm a specific political motivation against Colombia.
• The actor’s call for other actors to target the Colombian government may function as an attempt to activate a campaign or attract validation from third parties.

What Happened

Q22 published a message claiming that it had directed activity against resources associated with the Colombian government. The actor stated that it had targeted approximately 30 broadcasting resources and 8 government-affiliated satellite receivers across different areas of Colombia.

The message also claims that the satellite receivers were shut down and that the configuration of the radio resources was destroyed. In addition, Q22 invites other actors to direct hostile activity against the Colombian government and closes with a direct threat of continuity.

The visual support associated with the message shows screenshots of technical interfaces. Among them are screens from a Trimble environment with sections such as data files, satellite data, receiver configuration, and transfer functions. Audiovisual material also shows interfaces for managing connections or audio resources. These elements are consistent with access to exposed technical systems.

Operational Assessment

The main signal lies in the change of geography and target type. Q22 had already been observed as an emerging threat with attributed activity against dispersed targets, without a sufficiently clear doctrinal line. The new publication introduces Colombia as a possible focus and combines technical infrastructure, government references, and systems with possible operational value.

If the access were real, GNSS/satellite receivers and broadcasting resources could have value for georeferencing services, technical operations, communications, monitoring, or institutional support. However, the available material does not allow us to state that there was critical impact, sustained interruption, or physical or logical damage to the infrastructure.

Part of the visual material appears to be linked to technical ecosystems involving geodesy and GNSS reception, where public, institutional, and distributed infrastructure components may be compatible with systems used in Colombia. That does not automatically equal compromise of a sensitive government network, but it does make the signal more relevant than a simple website screenshot.

The tone and aesthetics of the message point both to intimidation and to attracting participation from other actors.

Intelligence Significance

For Q22 tracking, this publication adds an important data point: the actor may be testing or exploring targets outside its initial areas of activity, with a first visible signal toward Latin America. If similar publications involving Colombia or other countries in the region appear in the coming days, this activity could stop being read as an isolated event and start being interpreted as an emerging pattern with clearer signals.

This case also reinforces a hypothesis already raised by iQBlack: Q22 appears to operate with a target selection that is more opportunistic than doctrinal. At this stage, there is no clear political explanation that would justify Colombia as a priority target within a pro-Russian agenda.

The call for other actors to target the Colombian government deserves close attention. Although it does not prove coordination, it may function as a campaign signal or as an attempt to generate echo within the hacktivist ecosystem.

Analytical Closing

The intelligence value of Q22’s claim regarding alleged disruptions against technical resources linked to Colombia lies in the combination of three elements: an emerging threat, a new geography of interest, and a narrative targeting technical systems with possible institutional value. For now, iQBlack is limiting its assessment to observing the case, treating it as an early targeting signal involving Colombia, and maintaining follow-up on possible similar publications against government or technical resources in Latin America.