Threat actors by attributed origin

Brazil-Attributed Threat Actors.

Brandefense tracks 6 threat actors attributed to Brazil. The most documented are Lapsus$, Malteiro and Poseidon Group. The sectors they target most are Finance, Business Services and Manufacturing.

Top target sectorsFinance Business Services Manufacturing

MotivationEspionage Financial Ideology

6 of 6 published profiles shown

Cards Table

Actor	Type	Origin	Motivation	Sophistication	Exploited CVEs	Top malware
Lapsus$4 aliases	Ransomware	Brazil	Financial	Moderate	1	–
Malteiro0 aliases	Cybercrime	Brazil	Financial	Moderate	1	–
Poseidon Group1 alias	Nation-state APT	Brazil	Espionage	Advanced	–	–
REF93340 aliases	Cybercrime	Brazil	Financial	Advanced	–	–
Exilware0 aliases	Cybercrime	Brazil	Financial	Intermediate	–	–
Water Saci0 aliases	Unclassified	Brazil	Unknown	Not rated	–	–

On the Brandefense platform

IOC Feeds, YARA Rules And ATT&CK Navigator Exports For Every Actor.

Plus alerts when an actor in your sector starts exploiting a product you run, and detection rules you can load into your own tools.

Request A Demo

FAQ

Common Questions.

Each profile includes the actor's origin, type, active date range, target sectors and countries, MITRE ATT&CK TTPs, related CVEs, malware and tools used, recent campaigns, and motivation. Full IOC feeds and YARA rules are available on the Brandefense platform.
Yes. ATLAS Threat Actors DB covers nation-state APT groups such as Lazarus Group, cybercrime syndicates such as Scattered Spider, and ransomware operations. All profiles are maintained by Brandefense analysts.
IOC feeds, YARA rules, and MITRE ATT&CK navigator exports are available through the full Brandefense platform. Request a demo to get access.

Brazil-Attributed Threat Actors.

Common Questions.

What information is in an ATLAS threat actor profile?

Does ATLAS cover both APT groups and ransomware gangs?

How do I get IOC feeds and YARA rules for a specific threat actor?