Brazil Cybersecurity Snapshot, Aug. 2026

Active Threats and Campaigns in Brazil

Ransomware and simple extortion

There were 17 cases in August where ransomware or extortion was the primary focus, but the source only allowed a clear classification for a minority. In two cases, exfiltration without encryption was documented, in two there was only a mention on a leak site, and in 13 it was not possible to determine the exact impact from the available material.

That split matters because it prevents treating the whole block as if it were the same thing. A site listed by an actor is not the same as a data theft without encryption, or an attack with confirmed downtime. All three modes were present in Brazil, with preliminary signals outnumbering full confirmations.

Grupo Rái and LockBit 5.0

LockBit 5.0 claimed Grupo Rái in early August, and several aggregators showed it as data leaked or as a victim listed on a leak site. The recovered material did not allow a firm confirmation of operational damage, so the case should be read as an extortion claim with partial public evidence.

The significance of the case is not only the company targeted, but also LockBit 5.0's continued visibility in Brazil. This month's coverage again shows that the country remains among the markets most targeted by ransomware operators focused on data publication.

Mobilemed and Kazu

Mobilemed was claimed by Kazu as a victim in the health sector, with accounts that mention exfiltration and a ransom demand, but no official confirmation from the company. Some coverage describes it as an attack with possible broad impact on medical imaging and diagnostics, while other reports only repeat the actor's claim.

The taxonomy matters here. The available evidence supports describing it as a ransomware claim and, in some records, an alleged exfiltration, but not confirmed encryption. For the country report, that means keeping the case in the category of extortion with impact that cannot be verified in detail.

Intranet Gov Brasil and The Gentlemen

Intranet Gov Brasil was listed by The Gentlemen on leak sites and by incident aggregators as a claimed victim. There was no public confirmation from the federal government or from the state-owned companies mentioned in the material, so the case remains a leak site mention without corporate corroboration.

Even so, the claim matters because of the type of asset targeted, a portal and internal network for public services. The appearance of this name alongside other campaigns against municipal entities confirms that the government sector remained in the crosshairs of extortion groups throughout the month.

Fraud and phishing

The month showed a clear expansion in fraud, with nine documented cases and a strong bias toward banking, payments, and impersonation. The fake bank call center, social engineering against bank customers, deepfakes used for identity verification, and the TAG scheme point to the same abuse pattern, exploiting trust, urgency, and automation.

Fraud against crypto assets and payment methods also appeared, with the Central Bank accelerating controls to curb abuse of transfers and the PF disrupting electronic fraud networks. The operational takeaway is that attacks on identity and payment sessions carried more weight than classic intrusion.

APT, hacktivism and critical infrastructure

Brazil did not record a single local APT campaign in the material that dominated the month, but it was affected by the Lazarus context, the Siemens S7 advisory, and the debate over critical infrastructure. Added to that were disinformation lures and public-facing interface campaigns, such as the attempts against Rondônia portals and Flávio Bolsonaro's site.

In energy, water, government, and telecommunications, the risk was more closely tied to exposure and reconnaissance than to confirmed sabotage. The underlying threat was the combination of exposed attack surfaces, outdated critical software, and opportunistic campaigns seeking credentials, remote access, or public visibility.

Critical vulnerabilities with impact in Brazil

The month's vulnerability readout was limited, but significant. The material identified four critical CVEs, and all four show either active exploitation or direct operational impact. This does not mean there are no other relevant flaws outside the material, only that August's corpus prioritized these four as the verifiable signal.

Regulation and compliance in Brazil

Brazil tightened a regulatory agenda in August focused on data, fraud, and platform oversight. The clearest example was ANPD’s sanction against ByteDance, which showed the regulator is no longer limited to educational warnings and is willing to impose steep fines and specific data-deletion orders.

At the same time, the Central Bank moved ahead with Resolução BCB nº 584, which extends anti-fraud rules to virtual assets and sets a 24-hour precautionary hold for certain transfers. It also introduced authorization deadlines for virtual asset service providers, with a deadline of October 2026 and parts of the framework taking operational effect in January 2027.

In Pix, the regulator deepened its intervention with a centralized fraud-probability score, tracing of the money trail, and additional precautionary measures, including restricting new keys in cases of risk. This regulatory architecture is not cosmetic, because it responds to fraud already observed and to the need to coordinate banks, registries, and payment systems.

ANPD also kept expanding its compliance agenda. It published its semiannual report on the regulatory agenda, reviewed inspection and sanction rules, regulated transparency reporting, and maintained monitoring of platforms and AI tools to protect minors. In parallel, the Senate and the Chamber continued discussing texts on data protection, public security, and algorithmic transparency.

Most Affected Sectors in Brazil

The month hit at least seven sectors, but not evenly. Financial services were hit hardest in terms of both intensity and variety, with banking fraud, Pix, card payments, open finance, crypto assets, and police operations against money laundering networks. Government and public administration remained highly exposed, through both leaks and extortion campaigns and defacement.

Healthcare and pharmaceuticals also stood out. SISVISA, Mobilemed, and the Bahia case involving health data show that health information remains an attractive target, both for its regulatory sensitivity and its value in extortion. The logic is familiar, but the month confirmed that it remains active.

Telecommunications, logistics, and digital services added incidents or risk signals. LATAM, Uber Freight, Vivo, and various platform providers reflected a common pattern, dependence on identities, remote access, customer data, and third-party chains. The surface is fragmented, but the vector repeats.

In energy and utilities, the material did not show confirmed OT incidents in Brazil, but it did include alerts on critical infrastructure, campaigns against Siemens S7 PLCs, and references to sector-specific risk. That is enough to justify heightened vigilance, but not enough to make the vertical a focus of confirmed incidents for the month.

Trends and signals to watch in Brazil

Compared with the previous month, ransomware as the primary focus fell from 25 cases to 17, and unclassified incidents dropped from 10 to 6. At the same time, documented fraud and phishing rose sharply from 0 to 9, while regulatory moves declined from 13 to 11. The main shift was qualitative, the month moved away from being dominated by ransomware and instead combined fraud, regulation, and leaks.

That shift matters because it points to a more diversified visible risk. In July, the narrative was more centered on system hijacking. In August, the agenda moved toward data protection, identity, payments, virtual assets, and platform oversight. Ransomware did not disappear, but it lost relative centrality to other vectors.

Another clear signal is the consolidation of fraud as a cross-cutting problem. The mix of social engineering, deepfakes, fake portals, mule accounts, and attacks on registrars points to a more professional criminal ecosystem. The Central Bank and the PF responded with tougher tools, which will likely drive more behavioral controls and traceability.

On vulnerabilities, the month showed fewer critical CVEs mentioned than in July, from 5 to 4, but each carried real operational weight. The repeated presence of active exploitation and urgent patches in widely used software indicates that technical risk remains heavily concentrated in edge products, web platforms, and identity and access components.

Security recommendations for teams in Brazil

Five priorities stand out. First, banks, fintechs, and PSPs should review anti-fraud controls in Pix, identity checks, transfer monitoring, and detection of account ownership changes or mule accounts. The month showed that fraud is shifting toward automated, coordinated flows, not just isolated scams.

Second, organizations that handle sensitive data, especially in health, education, and government, should strengthen segmentation, backups, and public exposure controls. The SISVISA, Mobilemed, and municipal portal cases show that leak exposure does not depend only on ransomware, but also on weak configurations and accessible repositories.

Third, patch prioritization should be reviewed for the month’s four critical CVEs, with special focus on products exposed to the internet. Apache Tomcat, LoadMaster, Windows AFD, and JCE concentrate the type of exploitation that turns into a real incident fastest when exposure is public.

Fourth, compliance teams should treat the new regulatory wave as a security issue, not only a legal one. ANPD and the Central Bank are pushing controls on transparency, retention, traceability, consent, and reporting, so privacy, fraud, and cybersecurity now operate as one management block.

Fifth, the third-party chain should be reviewed. Several stories this month relied on vendors, registrars, cloud platforms, loyalty services, and third-party software, which makes it necessary to audit access, contracts, logging, and shared response capacity.

FAQ

What changed most between July and August in Brazil: ransomware, fraud, or regulation?

In August, ransomware lost relative weight compared with July, while fraud and phishing cases increased and the number of regulatory moves edged down slightly. The clearest shift was toward payments, identity, and personal data, which becomes clear when the period indicators are read alongside the trends section.

Which sector was most exposed based on confirmed incidents, and why?

The financial sector was the most exposed by the variety of events, followed by government and health. The combination of TAG, Pix, cryptocurrencies, Operação Klonen, LATAM Pass, SISVISA, and Mobilemed shows that pressure came from several fronts, not a single vector, and those fronts touched payments, identity, and sensitive data.

Do the 4 critical CVEs for the month mean there were four incidents in Brazil?

No. They mean that four critical vulnerabilities were mentioned in the material analyzed, several of them with active exploitation, but not that each one produced a separate Brazilian incident. The vulnerabilities table and the limitations section make clear that the absence of more CVEs in the month does not mean there was no regional exposure.

How confirmed was the Intranet Gov Brasil case?

It remained a leak site claim without public confirmation from the Brazilian government or the technical entities cited. That sets it apart from ICN, where an attack with encryption was confirmed, and from other cases where the material allows only a preliminary attribution.

What was the main regulatory signal for banks and fintechs?

The main signal was the tightening of oversight on fraud, Pix, and virtual assets. The Central Bank advanced on fraud probability scoring, money tracing, and precautionary crypto retention, while ANPD kept hardening sanctions and transparency. The two agendas appear separately in the body, but they converge in operational compliance.

Was there activity in Brazilian critical infrastructure without confirmed OT incidents?

Yes. There were alerts and signs of exposure, especially in energy, water, and industrial control, but no confirmed Brazilian OT incident appeared in the material. The risk was documented through international advisories and local coverage, so monitoring must continue even though the month did not register a completed OT operational impact.

Material limitations

This report was built exclusively from the material provided for Brazil in August 2026. The time window for the indicators includes 76 dated events in August 2026 and 2 events from prior months used only as a comparative frame, not as part of the month's volume. No internet or external material was used.

The table indicators are reproduced exactly as provided and describe what happened in the country, not the research process. A zero value, especially for CVEs or comparative categories, means that element did not appear in the material analyzed for the period, not that it did not exist in Brazil or the region.

Aggregated telemetry figures, such as attack attempts, blocks, scans, and weekly vendor averages, were also excluded from the count because they are not incidents with confirmed impact. When those figures are mentioned in the report, they are used only as context and always with the source and measurement window identified.

Primary sources were prioritized, including official agencies, CSIRTs, technical advisories from affected vendors, and regulatory statements. Promotional, sponsored, or low-verifiability sources were excluded from the main narrative as a sole basis for trend analysis, and undated events were not included in the counts. When a story depended only on a leak site or an aggregator, it was treated as an unconfirmed claim.