← All sectors

Ransomware in the Government & Defense sector

The Government & Defense sector has 30 known ransomware victims in Brazil. See the groups behind the attacks and the recent trend.

30victims

18groups

4in the last 90 days

Attack trend (12 months)

12

02

03

04

05

06

07

08

Groups attacking Government & Defense the most

babuk23 victims

apt733 victims

thegentlemen3 victims

lockbit33 victims

killsec3 victims

alphv2 victims

wannacry2 victims

qilin1 victims

ransomexx1 victims

ransomhub 🇷🇺1 victims

Vulnerabilities exploited against this sector

CVEs exploited by the groups attacking the Government & Defense sector — prioritize patching these.

CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsKEVused by ransomware CVE-2023-22518All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This ImpropeKEVused by ransomware CVE-2023-35078An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionaKEVused by ransomware CVE-2023-35082An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access resKEVused by ransomware CVE-2024-3400PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtectKEVused by ransomware CVE-2019-11510In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, anKEVused by ransomware CVE-2017-5638The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exKEVused by ransomware CVE-2019-0708A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services whKEVused by ransomware CVE-2019-19781An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, anKEVused by ransomware CVE-2020-5902In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, thKEVused by ransomware CVE-2021-21985The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in tKEVused by ransomware CVE-2021-22005The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actorKEVused by ransomware

Recent victims

Intranet Gov Brasilthegentlemen · 2026-08-06

The Municipal Chamber of Serrathegentlemen · 2026-07-31

gov.brapt73 · 2026-06-23

SECONT Secretaria de Controle e Transparêncianova · 2026-05-24

siapenet.gov.brapt73 · 2026-04-27

saude.mt.gov.brlockbit5 · 2026-03-19

Fundao Parathegentlemen · 2026-02-27

republica federative do brasilkillsec · 2025-12-15

aeamg.org.brlockbit3 · 2025-03-31

Municipal taxation Secretariat Access - Brazil Govermentbabuk2 · 2025-03-19

nuclep.gov.br. Nuclep Brazilbabuk2 · 2025-03-13

fnde.gov.br brazilian governmentbabuk2 · 2025-03-11

www.siapenet.gov.brapt73 · 2024-12-03

Government of Brazilkillsec · 2024-10-25

nfe.fazenda.gov.brkillsec · 2024-09-29