Brazil: Cybersecurity Situation, September 2026

Active Threats and Campaigns in Brazil

Ransomware and Extortion in Brazil

Ransomware and extortion activity in Brazil remained high, but this month’s material shows a mix of confirmed encryption, leaks, and unverified claims. The only case with confirmed asset encryption in the period’s reporting was the one involving judicial and service incidents, while most other events stayed at the level of group claims or leak site listings without complete independent proof.

Among the cases mentioned only on leak sites are K3G Solutions Brazil, Camorim Serviços Marítimos, and Receita Federal, each with different degrees of verification and with the caveat that the source does not always specify whether encryption occurred. In the K3G Solutions case, for example, the material refers to a publication threat and estimated exfiltration, but not to encryption confirmed by the victim.

There were also extortion incidents targeting manufacturing, technology, transportation, and education organizations, but in several cases the public evidence was limited to trackers or aggregators. For this report, that points to clear extortion pressure, but not to a uniform tally of technical impact.

Fraud, Phishing, and Synthetic Identity in Brazil

Fraud was one of the densest threat areas of the month, especially across the financial system. Pix drew multiple signals, from altered QR codes and copy-paste codes in online stores to new Central Bank rules for flagging suspicious CPFs and CNPJs, rejecting associated transactions, and notifying the user. At the same time, the courts and police continued documenting schemes built around stolen credentials, fake sites, and identity impersonation.

The clearest development was the consolidation of deepfakes and voice cloning as fraud tools. The material cites the theft of R$ 80 mil through facial recognition fooled by AI, campaigns that already account for 1 in every 15 fraud cases detected in Brazil in 2026, and estimated losses of R$ 1,8 mil millones between July 2025 and April 2026. That places synthetic identity among the top operational and financial risks.

There were also more traditional phishing campaigns, but more coordinated ones. The fake exam case for the police, which used the Cebraspe brand to carry out fraudulent Pix payments, shows a mix of social engineering, institutional impersonation, and abuse of trust in APIs or automated checks.

APT, AI-Assisted Intrusion, and Hacktivism in Brazil

There was no major classic state APT case in the September material, but there were several campaigns with persistent intrusion traits, automated tooling, and impact on public infrastructure. The most visible was the SEO poisoning operation against .gov.br domains, attributed to a Chinese-speaking actor, which compromised public servers and used search authority to redirect traffic to gambling and phishing.

In parallel, Unit 42, Cloud Security Alliance, and other sources described campaigns in Latin America with AI support, tunneling, custom RATs, and SOCKS5 proxies, with a financial focus in Brazil. Case CL-CRI-1163, in particular, involved phishing with a resume attachment, RATs, and SockTz to create a reverse SOCKS5 proxy. The material does not frame it as a state APT, but it does present it as organized and sustained intrusion.

There were also signs of hacktivism or broader abuse of public infrastructure. The Gambling Goblin campaign against .gov.br sites did not seek espionage or encryption, but rather reputation manipulation and monetization through gambling, with direct impact on Brazil’s public attack surface.

Critical vulnerabilities affecting Brazil

September’s technical pattern was clear, nearly all of the critical issues arrived with active exploitation or inclusion in KEV. That makes patching priority in Brazil depend not only on theoretical severity, but on real exposure and the presence of infrastructure with exposed edge systems, cloud identity, remote access or collaboration and commerce software.

Regulation and compliance in Brazil

Brazil had an intense regulatory agenda in September, with two main fronts, virtual assets and oversight of digital platforms. The Central Bank issued Resolutions BCB 587, 588 and 589, which tightened the regime for Pix, reporting to Coaf, and the relationship with unauthorized virtual asset providers. Implementation was also phased, with some provisions taking effect in October 2026 and others slated for 2027.

The most visible regulatory effect was on fraud and traceability. The new rules allow suspicious CPFs or CNPJs to be flagged, related transactions to be rejected, and participants to be required to retain the grounds and notify the user. At the same time, automatic reporting was expanded for transfers involving self-custodied wallets, and restrictions advanced for institutions that operate with unauthorized counterparties.

ANPD also made moves. It opened a public consultation on the oversight rule and the administrative sanctioning process, called a public hearing, and continued applying measures to platforms such as Discord. The Digital ECA framework sits in the background, because the data authority is already acting on services and platforms with likely impacts on minors and data protection.

The compliance reading is that Brazil is pushing regulated entities toward greater traceability, documentation of decisions and faster incident response. That applies to banks, fintechs, exchanges, digital platforms and, increasingly, public agencies with exposed services.

Most affected sectors in Brazil

The public sector felt the biggest impact this month in terms of disruption and exposure. Justice, federal agencies, data platforms, and bodies with shared infrastructure concentrated the most sensitive incidents. The issue was not just the number of events, but their ability to suspend deadlines, block hearings, take systems offline, or expose credentials and personal data.

The financial sector remained a structural target, driven by both fraud and technical exploitation. Pix, banks, fintechs, BRB, BRBJUS, and the deepfake cases show that money remains the strongest incentive and the fastest extraction channel. Regulatory pressure also fell on that ecosystem, a sign that the regulator sees sustained tension between innovation, availability, and fraud control.

Transport and logistics saw fewer cases, but they were no less relevant. Águia Branca showed that an incident in the sales channel is enough to trigger notification, containment, and access review. In health care, the picture was more about operational continuity and extortion than mass exposure, although Brazil's history in the sector and the mention of incidents at clinics and hospitals point to a persistent attack surface.

Trends and signals to watch in Brazil

Compared with August, September saw a sharp rise in unclassified incidents, a drop in documented fraud or phishing, and fewer regulatory moves, but more critical CVEs were cited. That mix suggests September was not a lower-risk month, but one with more operational and technical activity materializing in specific verticals.

The leading threat shifted from "unclassified" in August to "incidents" in September. That change matters because it points to more events with verifiable impact and less noise from complaints that were not categorized. Put another way, the September material makes it easier to see where the risk is hitting, even if it does not mean the ecosystem is any less hostile.

Two signals are still worth tracking. The first is the convergence of financial fraud and synthetic identity, which no longer appears as a lab-side trend but as behavior embedded in real campaigns. The second is the link between exploitation of critical CVEs and exposure of edge, identity, and collaboration services, a pattern that could keep affecting government, telecom, and the financial sector.

At the regional level, Brazil remains the main threat pressure point in Latin America. That does not mean everything is happening in Brazil, but rather that a disproportionate share of activity, especially financial and extortion-related activity, continues to concentrate there.

Recommendations for security teams in Brazil

1. Prioritize identity and access containment in judicial, financial, and government systems. If credentials were accessed or services became unavailable, the immediate focus should be reset, revocation, traceability, and session monitoring.

2. Review fraud rules in payment channels, especially Pix, QR, and transfers with strengthened authentication. This month’s material shows abuse of suspicion labels, fake accounts, voice cloning, and manipulation of receipts and payment confirmations.

3. Accelerate patching for the critical CVEs listed by CTIR Gov and for vulnerabilities with confirmed active exploitation in KEV. The most exposed surfaces are email, firewalls, remote access, collaboration tools, and self-managed software.

4. Review third-party exposure and the governance of external platforms. The BRBJUS and Águia Branca cases show that dependence on vendors or outside environments can turn a technical outage into an operational and reputational incident.

5. Strengthen fraud detection with non-biometric signals. This month made it clear that facial biometrics alone are not enough against deepfakes, face swaps, and voice cloning.

6. Keep notification and evidence procedures ready for ANPD, the Central Bank, and sector authorities. The cost of delay is no longer only reputational, it can also become a regulatory compliance issue.

7. Validate SEO poisoning controls, web hardening, and integrity monitoring on public or high-reputation sites. The campaign against .gov.br showed that a compromised site can be used as distribution and monetization infrastructure.

Frequently Asked Questions

What September clash tied justice, fraud, and operational continuity in Brazil?

The month linked two areas often analyzed separately, service disruption and financial fraud. The TJMT lost availability and credentials, while BRBJUS suffered downtime and funds diversion. Both cases show that a technical breach in Brazil can end up affecting court processes and money at the same time.

How are the Central Bank's new rules connected to Pix scams and deepfakes?

The Central Bank's new resolutions focus on suspicious markers, CPF and CNPJ traceability, and tighter controls over transfers involving self-custody. They respond to fraud that already uses deepfakes, voice cloning, altered QR codes, and stolen credentials, so regulation and technical controls are now aligned on the same front.

What is the link between critical CVEs and the sectors hit hardest this month?

The critical vulnerabilities affected the very surfaces most often seen in Brazilian incidents: email, remote access, identity, collaboration, and exposed public services. The clearest case was GitLab, with active exploitation, while CTIR Gov prioritized Cisco and Microsoft flaws that could affect government, finance, and critical operations.

Why does the report separate ransomware, extortion, and simple mention on a leak site?

Because they are not the same. In September there was one case with confirmed operational impact, several extortion claims, and several mentions on leak sites without public confirmation. Treating them as one would erase important differences for a CISO, especially when the source does not specify whether there was encryption or only the posting of the claim.

Which sectors should keep the closest watch on the compliance agenda?

Finance, the public sector, and digital platforms should keep the closest watch. The Central Bank tightened Pix and controls over virtual assets, while the ANPD expanded oversight of platforms and imposed measures on services affecting minors. That requires banks, fintechs, exchanges, and agencies handling sensitive data to coordinate legal, security, and operations teams.

Material limitations

This report was built exclusively from the material provided for September 2026 and from facts dated within that window. Facts from earlier months were used only as comparative context when the material allowed it, and any facts without a confirmed date were left out of the period indicators, although they may have been cited as qualitative context.

A zero value or an absence in the table does not mean the event did not occur in Brazil or in the region, only that it did not appear in the material analyzed for this month or could not be confirmed with the available evidence. This is especially important for CVEs, because the count reflects only what was recorded in the corpus, not the full set of vulnerabilities exploited in the country.

Aggregated telemetry on attempts, blocks or weekly vendor averages was excluded from the incident volume and can only be mentioned as background internet noise, not as confirmed impact. Promotional material, advertorials and some commercial releases were also left out as counting inputs, although they could still serve as context if corroborated by stronger sources.

Finally, the regulatory section includes decisions, consultations and rulings that fell within the time window, but it does not assume that every secondary press claim is equivalent to a rule already published. When the material did not allow us to determine whether there was encryption, exfiltration or only a claim on a leak site, that limitation was stated explicitly rather than forcing a classification.