Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Significant cyber incident
STJ court ransomware attack, Brazil, 2020
On 3 November 2020 a ransomware attack hit the network of Brazil's Superior Court of Justice (STJ) during judgment sessions.
In short
On 3 November 2020 a ransomware attack hit the network of Brazil's Superior Court of Justice (STJ) during judgment sessions. The court cut its internet links, lost its IT and phone systems and suspended sessions and deadlines. The STJ said the attack encrypted data but backups were intact, and it restored systems from backup over the following days. The national justice council later set up a cybersecurity committee for the whole judiciary.
What happened
On the afternoon of 3 November 2020 the STJ detected a hacker attack while judgment sessions were running by video conference in its six panels. The court said a virus was moving through its network. As a precaution it disconnected its internet links. That canceled the sessions and stopped its IT and telephone systems. Staff were already working from home because of the covid-19 pandemic.
The court president asked the Federal Police to investigate, and the Justice Minister ordered an inquiry. The STJ said the attack used encryption to block access to data, and that the data was safe in backup systems. Case information, email accounts and administrative contracts were intact, it said. Deadlines were suspended, and urgent matters were handled by the presidency.
Recovery started on 9 November with the main case system, using backups. Deadlines and some virtual sessions resumed on 10 November. The Federal Police inquiry is secret. The sources opened do not say whether data was copied, and the STJ’s own statements did not name the ransomware. News reports later linked it to RansomExx.
Timeline
-
3 November 2020
The STJ detects a hacker attack in the afternoon during judgment sessions. It disconnects its internet links, and sessions are canceled.
-
4 November 2020
Systems and the website are still down. Deadlines are suspended and urgent matters go to the presidency. The court tells staff not to use computers linked to its systems.
-
5 November 2020
The STJ says the Federal Police inquiry is running, that Microsoft and the Army Cyber Defence Centre are helping, and that data is preserved in backup. Other bodies, such as the Ministry of Health and the Federal District government, report problems the same day.
-
6 November 2020
Agência Brasil reports that the STJ has not said whether the case archive was compromised.
-
7 and 8 November 2020
A note says the Federal Police is checking the extent of file access and possible data copying. The Ministry of Economy digital government secretariat also helps.
-
9 November 2020
The STJ starts restoring systems from backup, beginning with the main case system, Sistema Justiça.
-
10 November 2020
Deadlines resume and the website, case search and case law search return. Video conference sessions are postponed a week.
-
10 and 11 November 2020
CNJ ordinance 242/2020 is dated 10 November and published on 11 November. It creates the Judiciary Cybersecurity Committee.
-
12 November 2020
The STJ says phone systems are fully back.
-
13 November 2020
Olhar Digital reports that the STJ says restoration is almost finished and that personal devices are barred from its network.
-
13 November 2020
The electoral court (TSE) says in a fact check that the STJ attack is no sign of a threat to voting machines, which are isolated devices.
-
19 November 2020
The STJ presidency says all restoration work is finished. It calls the attack the worst cyber attack yet against a Brazilian public institution in size and complexity, and says two-factor authentication was added.
-
10 March 2021
The CNJ committee finishes a draft cybersecurity strategy for the judiciary.
How the attack worked
The sources opened are public statements and news reports. None describes how the attackers got in. The Federal Police inquiry is secret, so the entry route is not public.
Spread inside the network
The STJ said a virus was circulating in its network on 3 November 2020. ConJur reported preliminary information that the attack came from a foreign private company and had been prepared for three months. It also reported that a minister said files held in the cloud were not reached, and only data on computers was encrypted. These are reports, not confirmed findings.
Encryption of data
The STJ said the attack blocked access to data using encryption (Data Encrypted for Impact, T1486). Olhar Digital, citing a security news report, reported that the ransom note found was consistent with RansomExx and that files got the extension .stj888. The STJ did not confirm the name in the statements opened.
Possible data theft
Olhar Digital described RansomExx as a malware family that steals sensitive documents while spreading, then encrypts. That is a general description of the family, not a finding about the STJ. The STJ said the Federal Police was checking possible data copying, and no result is public in the sources opened.
Why it stopped the court
The court cut its internet links at once. This stopped sessions, telephones and systems. Backups were intact, so the court rebuilt its environment from them, with help from Microsoft, the Army, Serpro, Atos Brasil and the federal digital government secretariat.
- IntrusionThe way in is not public; the inquiry is secret
- SpreadA virus moved through the court network on 3 November 2020
- EncryptData was locked using encryptionTechnique T1486 (MITRE ATT&CK, opens in a new tab)
- ContainThe court cut its internet links and canceled sessions
- RestoreSystems were rebuilt from backup from 9 November
ATT&CK techniques
Who says who was behind it
No official attribution. The STJ statements opened do not name a group or a ransomware family.
Reported by Olhar Digital, 13 November 2020, citing a security news report: the ransom note was consistent with RansomExx, a new version of Defray777.
Reported by ConJur, 10 November 2020: preliminary information said the attack came from a foreign private company and was planned for three months. This is not confirmed.
Reported by ConJur, 5 and 10 November 2020: President Bolsonaro said the Federal Police had identified the person responsible. A week later this was still unconfirmed.
Impact
The court's IT and telephone systems and website were down from 3 November 2020. All judgment sessions were suspended or canceled, and procedural deadlines were suspended until 9 November.
Several trials in the six panels were interrupted, and high-profile cases were postponed.
The STJ said case information, email accounts and administrative contracts stayed intact and that payroll commitments were unchanged.
Systems were restored gradually from backup from 9 November. Phones were fully back on 12 November. Video conference sessions resumed later than virtual sessions.
Whether data was copied is not stated in the sources opened. The Federal Police was checking this.
The STJ presidency (19 November 2020) called it the worst cyber attack yet against a Brazilian public institution in size and complexity. Its main case system, Sistema Justiça, was restored on 9 November and case distribution to all ministers on 10 November.
Government and regulator response
- 3 November 2020: the STJ cut internet links and asked the Federal Police to investigate. The Justice Minister ordered an inquiry.
- 3 and 4 November 2020: the STJ told ministers, staff, interns and contractors not to use any computer, even personal, connected to its systems until safe. Urgent matters went to an emergency mailbox at the presidency (CNJ news item).
- 5 November 2020: the STJ said Microsoft and the Army Cyber Defence Centre were helping to restore systems, and that backups were intact.
- 7 and 8 November 2020: the Ministry of Economy digital government secretariat also gave support. The Federal Police was checking file access and possible data copying under a secret inquiry.
- 9 November 2020: restoration began from backup. Serpro and Atos Brasil also helped, per the STJ.
- 10 and 11 November 2020: the president of the national justice council (CNJ) issued ordinance 242/2020, creating a cybersecurity committee. It had 20 days for prevention and crisis protocols, 30 days for an investigation protocol and 120 days for a strategy.
- 13 November 2020: Olhar Digital reported that the STJ barred personal devices from its network.
- 10 March 2021: the committee finished a draft strategy with minimum resilience and continuity standards.
- 19 November 2020: the STJ presidency said restoration work was complete. For 26 hours after the attack the network was left untouched to preserve evidence. More than 50 permanent staff worked on recovery, with the Federal Police, the Army Cyber Defence Command and Serpro cooperating in the secret inquiry. The court added two-factor authentication for system access.
Lessons
-
Backups decided the outcome
The STJ said its backups were intact and it restored from them. Without that, the court faced a choice between paying and losing its case files.
-
Cutting links stops spread and the business
Disconnecting the network limited the virus but also stopped sessions, phones and systems. Plan which services must run offline.
-
Remote work widens the risk
All staff were at home, and the court told them not to use any device linked to its systems, including personal ones. It later barred personal devices.
-
Run drills with outside helpers
The court called in Microsoft, the Army, Serpro and Atos Brasil. Know who you will call and what access they need before an incident.
-
One victim became a national program
The CNJ created a committee for the whole judiciary within days. Share lessons across peers and set minimum standards.
-
Be careful with early claims
The reports on a foreign company, a three-month plan and an identified culprit were unconfirmed. Say what is known and what is not.
What to check in your own organization
-
Backup isolation
Check that backups sit apart from the main network and that the same login cannot delete them. Test a full restore.
-
Restore order
List which systems come back first (for example the case or ticket system) and how long a full rebuild takes.
-
Network cut-off plan
Decide who can order an internet cut-off, and which services must still work if you do.
-
Personal and home devices
Set rules for staff devices that connect to your systems, especially under remote work.
-
Urgent-work fallback
Have a manual or backup route for urgent decisions and filings, such as an emergency mailbox.
-
Outside responders
Keep contacts and contracts for your national CERT or police, cloud providers and a recovery team.
-
Mass encryption alerts
Alert on sudden encryption of many files and on tools being switched off, on servers and PCs.
Where it happened
- Country Brazil Brazil faces banking trojans and fraud, ransomware against health services and other organizations, and state-linked campaigns. Latin America
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
Questions
What happened to the STJ in November 2020?
A ransomware attack on 3 November 2020 cut its systems during judgment sessions. The court said data was encrypted but kept in backups.
Which ransomware was it?
The STJ statements opened do not name it. Olhar Digital, citing a security news report, reported on 13 November 2020 that the ransom note matched RansomExx.
Was data lost?
The STJ said case information, email accounts and administrative contracts stayed intact. Whether data was copied is not stated in the sources opened.
How long was the court down?
Systems began returning on 9 November 2020. Deadlines and the website resumed on 10 November. Phones were fully back on 12 November, per Olhar Digital.
Who investigated?
The Federal Police, in a secret inquiry ordered by the Justice Minister at the STJ president's request. The Army Cyber Defence Centre helped with restoration.
Was anyone blamed?
There is no official attribution in the sources opened. President Bolsonaro said a person had been identified, but a week later this was unconfirmed.
How long was the network frozen to preserve evidence?
The STJ said that for 26 hours after the attack the network environment could not be manipulated, so that evidence of the crime was preserved. It then rebuilt the network after the forensic examination.
Did the attack show that Brazilian voting machines were at risk?
No, according to the electoral court (TSE). On 13 November 2020 it said the voting machines are isolated devices with no connection to the internet, unlike internal systems such as the STJ network.
What did the STJ change afterwards?
The presidency said it added two-factor authentication for access to its systems, and that challenges remain, including review of policies, the technology architecture and adapting to the data protection law (LGPD). The CNJ also created a cybersecurity committee for the whole judiciary.
Sources
- Comunicado, Ataque cibernético (STJ statement, 5 November 2020) Conselho da Justiça Federal
- Comunicado da Presidencia do STJ (19 November 2020) (archived copy) Superior Tribunal de Justica
- STJ suspende prazos processuais ate 9 de novembro apos ataque a sistemas (CNJ news, November 2020) Conselho Nacional de Justica
- STJ Noticias destaca reforco na seguranca de informacoes digitais do tribunal apos o ataque hacker (4 December 2020) (archived copy) Superior Tribunal de Justica
- Ataque hacker ao STJ nao e sinal de ameaca a seguranca das urnas (13 November 2020) (archived copy) Tribunal Superior Eleitoral (Fato ou Boato)
- STJ é alvo de ataque de hacker e Polícia Federal investiga o sistema Agência Brasil, 4 Nov 2020
- Polícia Federal investiga ataque cibernético no STJ Radioagência Nacional, 6 Nov 2020
- Após ataque hacker, sistemas do STJ começam ser restabelecidos Agência Brasil, 8 Nov 2020
- Superior Tribunal de Justiça reinicia hoje sessões virtuais Agência Brasil, 10 Nov 2020
- Após ataque ao STJ, Fux cria comitê para combater crimes virtuais Agência Brasil, Nov 2020
- CNJ cria Comitê de Segurança Cibernética do Poder Judiciário Conselho Nacional de Justiça, 12 Nov 2020
- Portaria nº 242/2020 Conselho Nacional de Justiça
- Comitê apresenta protocolos de segurança cibernética Conselho Nacional de Justiça, 12 Mar 2021
- Saiba como está o funcionamento do STJ após ataque hacker Consultor Jurídico, 10 Nov 2020
- STJ se restabelece após ransomware; PF investiga cópia de dados Olhar Digital, 13 Nov 2020
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.