Brazil

This page covers cyber threats to Brazil. It brings together official Brazilian texts (the Presidency decrees on cyber security, the data protection law and the data protection authority ANPD, the national CSIRT CERT.br, the Institutional Security Cabinet GSI and the Federal Police), a US advisory, MITRE ATT&CK and Brandefense research. Where an official source names Brazil as a target, the page says who said it and when.

Threat groups that official sources link to Brazil

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

Lazarus Group: the US advisory AA21-048A (last revised 15 April 2021) lists Brazil among the countries where AppleJeus malware was used against organizations since January 2020, in sectors including energy, finance, government, industry, technology and telecommunications. The FBI, CISA and Treasury attribute the Lazarus Group to North Korean state-sponsored actors.

MITRE ATT&CK also describes the Grandoreiro banking trojan, with confirmed victims in Brazil, Mexico, Portugal and Spain.

Incidents on record

No major incident page for Brazil is on record yet. We list only major incidents with national impact that official sources or the organizations themselves have reported, so small incidents are left out.

What official sources report

The ANPD said on 8 July 2026 that it opened a sanction process against a social organization that manages public health units in several states. The case comes from a 2025 ransomware incident that the organization said affected about 500,000 records, with health data such as exams, prescriptions, admissions and diagnoses. The ANPD is checking whether the organization broke the data protection law. The Federal Police list electronic bank fraud and high-technology crime among their cyber crime areas. CERT.br counts phishing, which includes fake pages aimed at banks, cards and e-commerce sites, and says its figures come only from networks that chose to report.

How attackers target Brazil: Brandefense research

Banking and fraud. The Grandoreiro Trojan Technical Analysis says MITRE ATT&CK records the trojan as first observed in 2016 and as targeting financial sector victims in Brazil, Mexico, Portugal and Spain. It adds that in January 2024 Brazilian authorities arrested five administrators of the operation, according to INTERPOL. Our RedLine Stealer post describes a sponsored Facebook post from an internet service provider’s account in Brazil that promised free Adobe Acrobat Reader but linked to a file-sharing site instead.

Ransomware. The Q2 2026 ransomware groups post lists Brazil among the primary geographic targets of DragonForce and among the most frequently targeted countries of the LockBit ecosystem. The Ransomware Trends Report for Q3 2023 says Brazil, Italy and Australia saw fewer ransomware attacks than in the previous quarter but stayed targets. The AvosLocker summary lists Brazil among its targets. The post on top ransomware groups says Lapsus$ targets include the Brazilian Ministry of Health.

State-linked. Our Lazarus APT38 profile lists Brazil among 18 countries where malware known to belong to the group was seen. The El Machete post lists Brazil among the countries the group targets with spearphishing in Latin America.

How Brandefense helps

In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins and payment cards are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

Decree 11.856 of 26 December 2023 created the National Cybersecurity Policy (PNCiber) and a National Cybersecurity Committee, which includes the central bank and the Brazilian Internet Steering Committee. Decree 12.573 of 4 August 2025 set up a new National Cybersecurity Strategy and repealed the 2020 strategy. The data protection law is Law 13.709 of 14 August 2018 (LGPD). Its fines go up to 2 percent of revenue in Brazil, capped at 50 million reais per infraction.

How incident response is organized

CERT.br is the national CSIRT of last resort, maintained by NIC.br, and is a focal point for incident notification. The GSI runs CTIR Gov, the government cyber incident center. Under the ANPD regulation, a controller must report a security incident that may bring relevant risk or harm to the ANPD within three working days of knowing that it affected personal data, and must tell the data subjects within three working days. The ANPD says telling the ANPD alone does not meet the duty in Article 48 of the LGPD. The Federal Police investigate cyber crime.

The official sources opened name no attack counts for Brazil. Figures will come from Brandefense Atlas.