Cyber Threat Actor: Paraná Cyber Mafia

The Paraná Cyber Mafia is a threat actor linked to website defacement campaigns targeting Brazilian government entities. The group has operated under the "Shawdy Boy" signature, which was publicly associated with attacks on state and municipal infrastructure. Their activities demonstrate a consistent focus on disruption through digital vandalism rather than data theft or financial extortion, with no evidence of secondary objectives like ransomware deployment or information exfiltration in reported incidents.

This actor primarily targets government web assets across multiple Brazilian states, including Bahia, Santa Catarina, and Piauí. Their operations aim to temporarily disrupt public services by compromising hosting providers like Prodeb, which manage centralized infrastructure for state agencies. The defacements affected security, civil police, and infrastructure department websites, causing operational interruptions during restoration periods. Attackers displayed administrative-level access to web servers but consistently avoided modifying backend systems or databases, suggesting either deliberate restraint or technical limitations.

Technical reporting indicates the Paraná Cyber Mafia leverages privileged access to web servers for defacement, though specific initial access vectors remain undocumented in available sources. The group publicly claims responsibility through cyber defacement archives like Zone-H, a common practice among hacktivist groups seeking visibility. Investigations by state security agencies, including Bahia's Security Secretariat, have involved civil police and intelligence units, but no public attributions to state-sponsored actors or criminal syndicates have been confirmed. The 2022 campaign against Prodeb-hosted government sites exemplifies their modus operandi, mirroring earlier attacks on 245 municipal sites in Santa Catarina through identical tactical signatures and targeting patterns.