Brazil: Panzer and Play list new victims

Panzer listed K3G Solutions, a Brazilian telecom and IT consultancy based in Manaus, on its leak site. At the same time, Play posted Metallco, a Brazilian manufacturing company, as a victim on its own site. In parallel, a Unit 42 report cited by The Hacker News described a campaign against Brazil's financial sector that used resume-themed phishing emails, custom RATs and tunneling tools.

What is known about the K3G Solutions case?

K3G Solutions Brazil appears in records from several trackers, but with different levels of confidence. Kalir Pulse included it among the victims posted by Panzer, while Recent Breaches treated it as an unverified claim and said it found no public confirmation from the company, no data types and no number of affected people.

Ransomware.live went further in its case file and attributed an estimated 300 GB of exfiltrated data, along with four compromised employees, 31 compromised users and four third-party employee credentials. Breach House, meanwhile, added K3G Solutions Brazil to its Brazil incident register as a Panzer claim and described it as a Brazilian telecom and IT consultancy based in Manaus.

What did Unit 42 say about the campaign in Brazil?

Unit 42, according to The Hacker News, detected a campaign identified as CL-CRI-1163 that targeted Brazil's financial sector with resume-based phishing emails to deploy custom RATs and tunneling tools. The cited material also mentioned a Go-based SOCKS5 proxy.

The Unit 42-linked findings add that initial access came through a resume-themed email attachment. The page identified in the search also pointed to attempts to install SockTz versions 1 through 8 from a compromised WordPress site. Unit 42 interpreted the iterative naming pattern in the Go-based SOCKS5 proxy as a possible sign of AI assistance in development.

What other cases appeared in Brazil?

Kalir Pulse also reported that Play listed Metallco as a victim on its leak site. The company is Brazilian and operates in manufacturing.

Taken together, the material includes two ransomware cases with Brazilian victims published on leak sites and an additional technical report that broadens the focus on campaigns aimed at organizations in the country, in this case with emphasis on the financial sector and deception tactics tied to resumes.