Cyber Threat Actor: sup3rm4n

sup3rm4nis an alias associated with a Brazilian hacktivist actor known for conducting website defacements against domestic targets. The actor operates from Brazil and has been linked to actions that combine criticism of government cybersecurity with protests against perceived corruption. Public reporting identifies sup3rm4n as part of a broader milieu of Brazilian hacktivists who use defacement as a means to draw attention to perceived institutional weaknesses and societal grievances.

The actor’s targeting has focused on Brazilian government research institutions and large domestic corporations, specifically the Brazilian Institute of research and development in Astronomy, Geophysics and Metrology of Time and Frequency (MCTI) and the conglomerate Odebrecht. These targets were chosen to highlight perceived vulnerabilities in national cyber defenses and to challenge entities implicated in the Petrobras corruption scandal. The strategic objectives expressed in the defacement messages include questioning the adequacy of government cyber infrastructure, suggesting that such weaknesses could enable foreign espionage by actors such as the NSA, and demanding an end to corporate theft from citizens. The actor frames these operations as protests aimed at promoting institutional accountability and exposing systemic corruption rather than seeking financial gain.

The reported tactics involve gaining unauthorized access to web domains and replacing the original content with defacement pages that display messages in Portuguese. No specific malware families, exploit kits, or custom tooling are mentioned in the available sources; the primary technique appears to be web defacement achieved through unspecified initial access vectors. The actor has used zone‑h mirrors to provide proof of the compromises, a common practice among defacement‑oriented groups to verify and publicize their successes.

Notable operations attributed to or aligned with sup3rm4n include the October 8 2015 defacement of the MCTI domains intranet.on.br and euler.on.br, which left a message critiquing Brazilian cybersecurity and referencing NSA surveillance capabilities. A contemporaneous hacktivist campaign in September 2015 saw the Odebrecht website defaced by the group ProtonWave, which issued a similar anti‑corruption warning and expressed support for Brazil’s Lava Jato investigation. While sup3rm4n is not directly named in the Odebrecht incident, the activity reflects a shared hacktivist motive and methodological approach within the Brazilian threat landscape during that period. All affected sites were subsequently restored by their owners.