Brazil Shows Up Again on Leak Sites

Brazil keeps surfacing on leak sites

IntelFusions said that in the 30 days through Aug. 8, 2026, there were 68 leak site claims against South American organizations. Nine of those targeted a government or educational entity, with several of the cases concentrated in Brazil.

Among the incidents IntelFusions reported was a claim by The Gentlemen against the Municipal Chamber of Serra, in the Brazilian state of Espírito Santo, dated July 31, 2026. Another claim, attributed to Krybit, targeted CESMAC University Center in Brazil on Aug. 4, 2026.

The same source also said that, among the South American claims it observed, there were at least two Brazilian victories attributed to L Group based on the group's own leak site monitoring.

Tactics noted by SecurityArsenal

In another report, SecurityArsenal said Direwolf posted a Brazilian victim, Chat Jurídico, as part of a wave of 10 new victim postings in 24 hours. The firm's analysis described observed tactics that include exploitation of publicly exposed applications, external remote services, command interpreter execution, WMI, obfuscation, file deletion and recovery inhibition, as well as encryption for impact.

Taken together, the two reports show Brazil exposed across municipal and education sectors, while Direwolf also adds a local victim to its public list. The threat intelligence sources point to an operation built around access to exposed services and actions meant to slow response and restoration.