CoPilotLeaks: A Look at the Threat Actor’s TTPs, History and More

Introduction

CopilotLeaks is a criminal threat actor group known for its data breaches and leaks targeting various sectors in Bolivia and Paraguay. The group operates under multiple aliases, including Megumi, vulnerandolo, and Johan_Liebheart. Their primary motivation is personal gain, and they are characterized as having an intermediate level of sophistication. The group first emerged in November 2025 and has been active in exploiting vulnerabilities in governmental and educational institutions to exfiltrate sensitive data.

Victimology

CopilotLeaks primarily targets governmental and educational institutions in Bolivia and Paraguay. Notable incidents include:

• Government Breach Paraguay: In November 2025, Johan_Liebheart claimed to have breached a  system in Paraguay, accessing a database containing sensitive information from a government ministry.
• School, Bolivia: In October 2025, the actor vulnerandolo reported a breach resulting in the theft of approximately 10.3 million records, including civil information of Bolivian citizens.
• A LATAM Attorney General: Megumi disclosed sensitive data from prosecutors, including personal identifiers and official documents.

TTPs (Tactics, Techniques, and Procedures)

The group employs various tactics and techniques consistent with their criminal activities. Key attack patterns include:

• Data Encrypted for Impact (T1486): The group encrypts sensitive data to leverage it for ransom or public exposure.
• Exploitation of Remote Services (T1210): They exploit vulnerabilities in remote services to gain unauthorized access to sensitive databases.
• Data Destruction (T1485): In some instances, they may destroy data to cover their tracks or as a form of retaliation against targets.

Origins and Affiliates

CopilotLeaks has established connections with other cybercriminals and groups, particularly within the dark web community. They utilize platforms such as DarkForums and Telegram to communicate and share information about their exploits. The group appears to collaborate with individuals like vulnerandolo, who has been involved in multiple data breaches and leaks.

Community Presence

CopilotLeaks maintains an active presence on various online platforms, particularly:

• DarkForums: They use this forum to announce leaks, share data, and interact with other users.
• Telegram: The group operates a channel (@CopilotLeaks) where they disseminate information about their activities, including data leaks and offers for access to sensitive databases. They also promote their services, such as data queries and doxing capabilities, often incentivizing user engagement through promotions and token systems.

About Check Point External Risk Management (formerly Cyberint)

Check Point’s External Risk Management solution is built to uncover threats before they cause damage. By continuously monitoring forums, credential abuse, and chatter across the open, deep and dark web, the team can detect campaigns in their earliest stages. The platform’s ability to correlate indicators across multiple clusters—ads, domains, Telegram activity, and more—helps link disparate attacks to a single network. That’s how we move fast, disrupt infrastructure, and protect organizations.