Executive Summary

Emerging actor Switzerland Nation has published material presented as official documentation linked to the Mexican state of Yucatán, marking the second known operation under this new identity since its appearance in the second half of August.

According to iQBlack monitoring, Switzerland Nation was created by operators previously associated with Chronus Team and SoulHemTeam. Its first known publication targeted Argentine healthcare company Sancor Salud in late August. The activity now associated with Yucatán rapidly expands the actor’s visible footprint into Mexico, another country already recurrent within the ecosystem from which some of its members originate.

The publication provides an important early signal for characterizing the new actor. However, the presence of apparently official documents does not yet establish that Switzerland Nation directly compromised current systems belonging to the Government of Yucatán or that the material resulted from a recent intrusion.

A New Identity Built on Pre-Existing Relationships

Switzerland Nation’s operational history remains too short to define its structure, technical capabilities, or degree of autonomy with confidence. Its origins, however, provide several initial reference points.

iQBlack internal records place its formation in the second half of August and link its creation to a member of Chronus Team and the founder of SoulHemTeam. This does not automatically make Switzerland Nation an alias or extension of either group, but it does place the actor within an existing network of relationships.

The creation of a new identity also does not necessarily imply the simultaneous emergence of new capabilities. Operators, contacts, knowledge of targets, access sources, and previously obtained material can move between structures or be reorganized under a new banner.

Future operations will help determine whether Switzerland Nation develops an independent identity or begins to display clearer continuity with the actors from which some of its members originated.

Argentina First, Mexico Next

The first known publication under the Switzerland Nation name was associated with Sancor Salud, an Argentine healthcare organization, and appeared in late August. The material now linked to Yucatán represents the second recorded episode and expands the actor’s known activity from Argentina into Mexico.

For now, two operations are insufficient to establish a consolidated victimology. The initial selection of these two countries is nevertheless noteworthy because both Mexico and Argentina have appeared repeatedly within Chronus Team’s operational environment.

This introduces an early hypothesis worth monitoring: the new identity is beginning its activity within geographic spaces already familiar to some of its members.

More Than a Second Leak

Within only a few weeks, the actor has established an initial operational sequence spanning Argentina and Mexico and has used public dissemination platforms to give visibility to material attributed to organizations in both countries.

At the same time, its early links to members originating from other groups illustrate how new identities can emerge within an ecosystem where relationships between operators may persist even as the names used publicly change.

Analytical Closing

Two publications are not enough to define an actor’s trajectory. They are, however, enough to establish a starting point.

Switzerland Nation appears to be a recent identity, but not necessarily one formed by inexperienced operators. Its initial transition from an Argentine organization to material associated with a Mexican public administration introduces a signal that should be tested against future activity.

The Yucatán publication also highlights an essential distinction when assessing this kind of activity: possessing information does not necessarily demonstrate how, when, or from where it was obtained.

The actor’s next victims, publication methods, and relationships will help determine whether Switzerland Nation represents the emergence of a genuinely new structure or a reorganization of capabilities and operators already present within the regional ecosystem.