Coletivo Internacional Anonymous

Profile narrative

Coletivo Internacional Anonymous is a hacktivist collective that has been publicly identified in Brazilian cyber incident reports as operating from Brazil. The group uses the alias Coletivo Internacional Anonymous and has claimed responsibility for attempts to compromise municipal government websites in the country. Its activities are characterized by actions that aim to disrupt online services rather than to pursue financial gain or espionage, with stated motivations tied to social protest causes such as demanding investigations into sexual harassment cases in universities. The collective’s targeting appears focused on local governmental portals, particularly those of city councils, where it seeks to draw public attention to specific societal issues through the temporary impairment of those online services.

Publicly reported operations attributed to Coletivo Internacional Anonymous include an attempted cyber attack on the Câmara Municipal de Salvador on October 6 2023, during which suspicious activity was detected on the technological infrastructure hosting the council’s portal; the city’s technical team responded promptly and reported no impact on data integrity, confidentiality, or availability. In August 2022, the group was linked to an intrusion against the website of the Municipal Chamber of Teresina, where visitors encountered an “Access Denied” message, indicating a disruption of normal access to the portal. Earlier, in 2021, the portal of the Câmara Municipal de Belo Horizonte was taken offline, forcing the council to transmit its regular meetings via its official YouTube channel while technical staff worked to restore the site. Across these incidents, the described outcomes involve service interruption or denial of access without evidence of data exfiltration or financial theft, aligning with the group’s protest‑oriented objectives.

Attribution to Coletivo Internacional Anonymous rests solely on the group’s own claims and the contextual details provided by affected institutions; no public evidence links the collective to a state sponsor, a criminal consortium, or any specific malware families, toolkits, or initial access vectors. Consequently, the known tactics, techniques, and procedures are limited to the observed effect of rendering municipal websites temporarily inaccessible, as demonstrated by the “Access Denied” notices and the shift to alternative communication platforms such as YouTube for public meetings. Because the source material does not detail specific malware, exploit tools, or infrastructure used, the profile remains confined to the confirmed facts of targeting, disruption outcomes, and the group’s self‑stated protest motives.

Incidents

Attributed incidents are available to members.