Mandiant has published a report looking at cyber threats targeting Brazil, finding that more than 85% of government-backed phishing activity comes from threat actors based in China, North Korea and Russia.
“The Brazil-focused targeting of these groups mirrors the broader priorities and industry targeting trends we see elsewhere,” the researchers write.
“North Korean government-backed groups, for example, have shown a keen interest in Brazilian cryptocurrency firms, aerospace and defense, and government targets. PRC groups, meanwhile, have targeted Brazilian government organizations, as well as the energy sector.
Russian cyber espionage groups have targeted users in Brazil regularly dating back more than a decade; however since the start of Russia’s war in Ukraine, Russian activity targeting Brazil has scaled back considerably - likely an indication of Russia’s efforts to focus resources on Ukrainian and NATO targets in the context of the Russia-Ukraine war.”
North Korean threat actors are targeting Brazilian entities with a combination of financially motivated and espionage-focused spear phishing attacks. Mandiant notes that Brazilian organizations, especially startups, should be on the lookout for North Korean individuals attempting to gain fraudulent employment.
“One of the emerging trends we are witnessing globally from North Korean threat activity today is the insider threat posed by North Korean nationals gaining employment surreptitiously at corporations to conduct work in various IT roles,” the researchers write.
“Though we have not yet observed direct connections between any of these North Korean IT workers and Brazilian enterprises, we note the potential for it to present a future risk given the growing startup ecosystem in Brazil, historical activity by North Korean threat actors in Brazil, and expansiveness of this problem.”
Criminal threat actors are also launching phishing attacks against Brazilians, often impersonating the country’s tax and finance entities. The crooks also target users of Latin American payment platforms. The researchers note, “Consistent with past trends, we continue to see threat actors from Latin American underground communities primarily advertise products designed to target their own region.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Mandiant has the story.
Here's how it works:
