Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
68 IOCs
Hidden Infrastructure Exposed: ANY.RUN Reveals Hijacked Gov Websites Delivering Malware
Malware Families
Excerpt
An original threat intelligence investigation uncovering how trusted government infrastructure became an attack channel, placing banking organizations and public-sector systems at risk while revealing previously undocumented infrastructure relationships and actionable mitigation guidance for security leaders. ANY.RUN analysts have uncovered an active PhantomEnigma campaign abusing compromised government infrastructure and fake…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →68 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | portaldrh.tjba.jus.br | High | Score 58/100 | First seen |
| URL | https://zsxocjarsate.com/nbw/ | High | Score 58/100 | First seen |
| URL | https://protocolo.sorocaba.sp.gov.br/protocolo/signkit.jsp?yd=5F8bz2Lapfi%2Bf41ZRmsNAtfvOls6zkkpOSPYO4UqALf0x8Hv%2BZcPRgcBznBl0tH </li> | High | Score 58/100 | First seen |
| URL | https://url.de.m.mimecastprotect.com/s/cFJoCr2PqncDzNRl7U7fmf4fQ3q?domain=camaraparaguacu.sp.gov.br </li> | High | Score 58/100 | First seen |
| URL | https://www.funrespol.pc.ro.gov.br/procedimento/aQbax7Lq4R | High | Score 58/100 | First seen |
| SHA256 | e0dae1a04b7a3b2ae07377b0fd00681e9633532788870b3709a9e149f3ccf0e0 | High | Score 86/100 | First seen |
| IP | 158.94.208.120 | High | Score 58/100 | First seen |
| IP | 91.92.241.181 | High | Score 58/100 | First seen |
| URL | https://circ.rs.gov.br/OficioDigital.exe | High | Score 58/100 | First seen |
| URL | https://marapoama.sp.gov.br/doc/4h7Bae/Mn9K3N | High | Score 58/100 | First seen |
| URL | https://ferrazdevasconcelos.sp.gov.br/down.php | High | Score 58/100 | First seen |
| URL | https://camaraparaguacu.sp.gov.br/doc/naNXNW0tQ7 | High | Score 58/100 | First seen |
| URL | https://camaraparaguacu.sp.gov.br/doc | High | Score 58/100 | First seen |
| URL | https://poa.sp.gov.br/oficio/anexo/VQC7WEcf | High | Score 58/100 | First seen |
| Domain | dahieenloo.com | High | Score 58/100 | First seen |
| URL | https://condemat.sp.gov.br/certificate/APL3SJ9e/723406349/ | High | Score 58/100 | First seen |
| IP | 79.110.49.32 | High | Score 58/100 | First seen |
| URL | https://poa.sp.gov.br/download/7552PRc3/544840142/ | High | Score 58/100 | First seen |
| Domain | loginam.sesp.es.gov.br | High | Score 58/100 | First seen |
| URL | https://poa.sp.gov.br/documento/3QFKMM71/527058494/ | High | Score 58/100 | First seen |
| Domain | psznaoehteeh.com | High | Score 58/100 | First seen |
| URL | https://camaraparaguacu.sp.gov.br/doc/wsVPWyP0iL | High | Score 58/100 | First seen |
| IP | 195.177.94.103 | High | Score 58/100 | First seen |
| URL | https://poa.sp.gov.br/doc/wBvCEwP3tO/oSKmMKG1sw | High | Score 58/100 | First seen |
| Domain | funrespol.pc.ro.gov.br | High | Score 58/100 | First seen |
| URL | https://camaraparaguacu.sp.gov.br/doc/R0RU5TEpc2 | High | Score 58/100 | First seen |
| URL | https://camaraparaguacu.sp.gov.br/doc/i00hqHrGFr | High | Score 58/100 | First seen |
| URL | https://camaradelassance.mg.gov.br | High | Score 58/100 | First seen |
| URL | https://www.pinhalgrande.rs.gov.br/down.php | High | Score 58/100 | First seen |
| Domain | oficiospolicia.com | High | Score 83/100 | First seen |
| IP | 185.219.83.191 | High | Score 58/100 | First seen |
| URL | https://marapoama.sp.gov.br/levantamento/M5nkwP/dM0CgC | High | Score 58/100 | First seen |
| URL | https://camaraparaguacu.sp.gov.br/doc/DcUXKm/S7q88t | High | Score 58/100 | First seen |
| SHA256 | 71f69978667dc421e7edf8885e9f3bde9dd527d9f7974228c9a6eac84c2ab71c | Medium | Score 53/100 | First seen |
| Domain | compromised.gov.br | High | Score 58/100 | First seen |
| Domain | novoservidor2026.com | High | Score 58/100 | First seen |
| URL | https://marapoama.sp.gov.br/oficio/LA9ks3d/ldo9JodAS/vYnerL/fkeA5r | High | Score 58/100 | First seen |
| Domain | pinhalgrande.rs.gov.br | High | Score 58/100 | First seen |
| Domain | zabbxsoftware.com | High | Score 58/100 | First seen |
| URL | https://marapoama.sp.gov.br/documento/L5fHnY/d13mLf | High | Score 58/100 | First seen |
| Domain | timon.ma.gov.br | High | Score 58/100 | First seen |
| URL | https://camaraparaguacu.sp.gov.br/oficio/mGeI1KrXIT | High | Score 58/100 | First seen |
| Domain | pccvioo.com | High | Score 58/100 | First seen |
| URL | https://protocolo.sorocaba.sp.gov.br/protocolo/kitsigns.jsp?yd=DtmcOmPD4GdPF9H06LU6tVN8lm2467QxWGDEOmFL0qWjScIylunV8re%2B0cZMiJ6O </li> | High | Score 58/100 | First seen |
| Domain | areal.rj.gov.br | High | Score 58/100 | First seen |
| Domain | policiacivil.pe.gov.br | High | Score 58/100 | First seen |
| IP | 188.137.246.189 | High | Score 58/100 | First seen |
| URL | https://camaraparaguacu.sp.gov.br/doc/DzAe8Sxvca | High | Score 58/100 | First seen |
| SHA1 | 18576cf8abd7812271cef15c8c401c7207caa231 | Medium | Score 53/100 | First seen |
| URL | https://lontra.mg.gov.br/arquivo.php | High | Score 58/100 | First seen |
| URL | https://poa.sp.gov.br/doc/k9l00oFolA/4mZKTCE4ex | High | Score 58/100 | First seen |
| Domain | kak.is | High | Score 73/100 | First seen |
| Domain | taaeiuep.com | High | Score 86/100 | First seen |
| Domain | pccvill.com | High | Score 58/100 | First seen |
| Domain | gov.br | Low | Score 31/100 | First seen |
| URL | https://floresdegoias.go.gov.br/levantamento/v6aq7x/prm9yG | High | Score 58/100 | First seen |
| IP | 45.141.119.188 | High | Score 58/100 | First seen |
| Domain | logs.zabbxsoftware.com | High | Score 58/100 | First seen |
| URL | https://poa.sp.gov.br/doc/KhDvexT9QX/t4iVaErskj | High | Score 58/100 | First seen |
| Domain | oauth.openvpnet.com | High | Score 58/100 | First seen |
| Domain | seplag.mt.gov.br | High | Score 58/100 | First seen |
| Domain | policiacivilmg.com | High | Score 58/100 | First seen |
| SHA1 | a9e499076e60cd525b23d7c667f1929bc0a9b294 | Medium | Score 53/100 | First seen |
| Domain | eeresofeuae.com | High | Score 58/100 | First seen |
| Domain | prodoc.ap.gov.br | High | Score 58/100 | First seen |
| URL | https://camaraparaguacu.sp.gov.br/doc/js.brnUl8Z | High | Score 58/100 | First seen |
| URL | https://arcese.urlsand.com/?u=https%3A%2F%2Fcamaraparaguacu.sp.gov.br%2Foficio%2Fx2eDBGceCF&e=dd4b7717&h=be3cf1fa&f=y&p=y&m=4gql0c4CXBz334D </li> | High | Score 58/100 | First seen |
| Domain | aplicacao.cbm.mt.gov.br | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…