RECAP

April 2026

All months Next month →

1incidents investigated · 1 in Brazil

31entered active exploitation · 9 used by ransomware

17ransomware victims · 17 in Brazil

9active groups

5,838new vulnerabilities · 573 critical

What we investigated

Each case with its confidence seal and verdict — not rumors.

Grupo alega roubo de dados do Gov.br — análise indica base recicladaRecycled

Buddha · governo · 19 Apr 2026

What actually came under attack

Vulnerabilities added to CISA's KEV catalog during the month: confirmed active exploitation.

CVE-2024-27199 ⚠

JetBrains TeamCity

HIGH · 7.3 · EPSS 100%

CVE-2026-41940 ⚠

WebPros cPanel & WHM and WP2 (WordPress Squared)

CRITICAL · 9.3 · EPSS 99%

CVE-2024-1708 ⚠

ConnectWise ScreenConnect

HIGH · 8.4 · EPSS 95%

CVE-2023-27351 ⚠

PaperCut NG/MF

HIGH · 8.2 · EPSS 78%

CVE-2024-57726 ⚠

SimpleHelp SimpleHelp

CRITICAL · 9.9 · EPSS 66%

CVE-2024-57728 ⚠

SimpleHelp SimpleHelp

HIGH · 7.2 · EPSS 64%

CVE-2023-21529 ⚠

Microsoft Exchange Server

HIGH · 8.8 · EPSS 59%

CRITICAL · 9.3 · EPSS 100%

CVE-2026-1340

Ivanti Endpoint Manager Mobile (EPMM)

CRITICAL · 9.8 · EPSS 99%

CVE-2026-34197

Apache ActiveMQ

HIGH · 8.8 · EPSS 98%

CVE-2026-21643

Fortinet FortiClient EMS

CRITICAL · 9.1 · EPSS 98%

CVE-2026-35616

Fortinet FortiClient EMS

CRITICAL · 9.1 · EPSS 94%

CVE-2024-7399

Samsung MagicINFO 9 Server

HIGH · 8.8 · EPSS 92%

CVE-2025-29635

D-Link DIR-823X

HIGH · 7.2 · EPSS 88%

CVE-2026-32202

Microsoft Windows

MEDIUM · 4.3 · EPSS 71%

CVE-2026-32201

Microsoft SharePoint Server

MEDIUM · 6.5 · EPSS 43%

CVE-2009-0238

Microsoft Office

HIGH · 8.8 · EPSS 43%

CVE-2026-20133

Cisco Catalyst SD-WAN Manager

MEDIUM · 6.5 · EPSS 35%

CVE-2020-9715

Adobe Acrobat

HIGH · 7.8 · EPSS 33%

CVE-2026-20122

Cisco Catalyst SD-WAN Manger

MEDIUM · 5.4 · EPSS 26%

CVE-2012-1854

Microsoft Visual Basic for Applications (VBA)

HIGH · 7.8 · EPSS 21%

CVE-2026-5281

Google Dawn

HIGH · 8.8 · EPSS 14%

CVE-2023-36424

Microsoft Windows

HIGH · 7.8 · EPSS 12%

CVE-2026-20128

Cisco Catalyst SD-WAN Manager

HIGH · 7.5 · EPSS 8%

CVE-2026-34621

Adobe Acrobat and Reader

Kentico Kentico Xperience

HIGH · 7.2 · EPSS 4%

CVE-2025-32975

Quest KACE Systems Management Appliance (SMA)

CRITICAL · 10.0 · EPSS 2%

CVE-2025-48700

Synacor Zimbra Collaboration Suite (ZCS)

MEDIUM · 6.1 · EPSS 2%

Who attacked most

lockbit54 (4 BR)

coinbasecartel3 (3 BR)

thegentlemen3 (3 BR)

apt732 (2 BR)

worldleaks1 (1 BR)

dragonforce1 (1 BR)

krybit1 (1 BR)

blackwater1 (1 BR)

Victims in Brazil

Organizations listed on extortion sites. Appearing there is the criminal's CLAIM, not a confirmation.

lbreng.com.br

lockbit5 · Professional Services · 30 Apr 2026

sweetome.com

lockbit5 · Retail & E-Commerce · 30 Apr 2026

sella.eng.br

apt73 · Technology · 27 Apr 2026

siapenet.gov.br

apt73 · Government & Defense · 27 Apr 2026

Colegio Notre Dame Campinas

thegentlemen · Education · 27 Apr 2026

Sea Telecom Br

coinbasecartel · Technology · 23 Apr 2026

Laboratório Santa Luzia

thegentlemen · Healthcare · 19 Apr 2026

erstransportes.com.br

lockbit5 · Transportation/Logistics · 17 Apr 2026

Grupo EBD

blackwater · Professional Services · 17 Apr 2026

Greenpharma

thegentlemen · Healthcare · 15 Apr 2026

secran.com.br

krybit · Professional Services · 14 Apr 2026

novafp.com

dragonforce · Professional Services · 14 Apr 2026

erstransportes.com.br

lockbit5 · Transportation · 14 Apr 2026

DIME Distribuidora

worldleaks · Transportation · 10 Apr 2026

Correios

coinbasecartel · Transportation · 08 Apr 2026

JBS Brazil - Sample uploaded

coinbasecartel · Agriculture and Food Production · 08 Apr 2026

Ipiranga Contábil

gunra · Professional Services · 08 Apr 2026