Banking malware in LATAM: countries with data and coverage gaps

This analysis addresses a bounded question: which countries are named in the financial malware dataset’s references? It does not estimate the number of infected people or identify the region’s most dangerous country. That distinction determines how to interpret both the figures and the empty areas on the map.

Two dataset snapshots, not two risk estimates

The article retains the data from September 17, 2026 and the update from September 29. These are separate documentary versions: a count from the first must not be combined with the second version’s denominator. Snapshot dates also do not replace the publication date of each source.

• September 17: 56 families; seven of the map’s 27 territories have country-specific references and twenty have none. Brazil is associated with 29 of the 56 families.
• September 29: eleven additions bring the set to 67 families and nine countries with data; Venezuela and Costa Rica are added. Brazil is associated with 36 of 67.

These values are retained from the published analysis. They are neither a recalculation of the current Atlas nor a new activity measurement. The dataset’s citability guarantees explain why an identifiable version matters as much as the number being cited.

What the September 17 snapshot shows

The 56 families carry a reference to a country in the region or to “LATAM” in general. The seven countries named in that snapshot are Brazil, Mexico, Peru, Argentina, Chile, Colombia and Paraguay. The recorded breakdown is:

• Brazil: 29 families, approximately 52% of the total; 19 for Windows, including PoS/ATM, and ten for Android.
• Mexico: eleven; Peru: five; Argentina: four; Chile and Colombia: two each; Paraguay: one.
• Regional label: fifteen families carry “LATAM”; nine without a specific country and six also with an ISO country.

A family can be associated with several countries. Adding national rows therefore does not produce 56 distinct families. Nor should the nine regional-only references be distributed across all countries: the source provides no such breakdown.

How to interpret a country without references

A gap describes the limits of the reviewed corpus. It does not establish that a country is free of banking malware. The original note offers three possible explanations: few local sources, reports using a global label without naming the country, or publication after the snapshot. These are coverage possibilities, not established causes for each territory.

Brazil’s larger share reflects the concentration of references in this set. It cannot rank countries by victims, losses or infection probability. Those comparisons would require other evidence with comparable units and periods.

Using coverage in a CTI investigation

The map is an entry point to references, not a substitute for reading them. In the Atlas explorer, open the profile and check what the source actually states: the country named, regional or local scope, and the period described.

• When citing a count, identify its snapshot: “29 of 56” and “36 of 67” describe different versions, not shares of infections.
• When a “LATAM” reference has no country, retain that uncertainty. Do not supply a location based on proximity or the report’s language.
• For a country without references, seek information from relevant vendors and CERTs. That search supplements the corpus; it does not predict what those organizations will find.

The conclusion is documentary: we know where this version has references and where gaps remain. The method notes distinguish documented material, interpretations and the limits of each claim.

Version note: the figures in this analysis reflect the dataset cut-off in effect at the time of publication; the Atlas is updated continuously.