20+ Hijacked Government Websites Became an Attack Channel

An active campaign, known as PhantomEnigma, has been uncovered, in which over 20 Brazilian government websites were compromised and used to distribute malware. The campaign was discovered by ANY.RUN, a threat intelligence solutions provider. The investigation into the campaign revealed new information about the backdoor behavior used by the attackers, as well as connections between the campaign's infrastructure and multiple attack methods. The campaign is still ongoing, with the hijacked websites serving as a channel for malware delivery. ANY.RUN's findings have shed light on the scope and complexity of the PhantomEnigma campaign. The discovery has provided new insights into the tactics and infrastructure used by the attackers.