Cyber Threat Actor: Threat Group-3000

The threat actor tracked asThreat Group-3000, also known by the aliases TG-3000 and Group-3000, has been referenced in open-source reporting with a noted connection to Brazil. While the exact geographic base remains unspecified, the actor’s location is indicated as Brazil in the available context. No additional details about the group’s size, structure, or affiliations are publicly disclosed.

The only publicly attributed incident involving this actor occurred on January 12, 2021, when a Brazilian fuel distributor suffered a ransomware attack. The intrusion disrupted operations at several of the company’s subsidiaries, leading to temporary service interruptions. The ransomware payload encrypted systems sufficiently to halt normal business functions at the affected sites. No specific malware family or variant was named in the reporting.

Following the incident, the fuel distributor implemented additional security measures and began a gradual restoration of its operating systems. According to the company’s statements, critical information systems were returned to full operation shortly after the attack began. The organization did not disclose further technical details about the attack vector, the ransomware used, or any potential data loss.

Because the reporting does not provide evidence of state sponsorship, criminal consortium ties, or other campaigns, any assertion about the actor’s strategic objectives or broader targeting patterns would be speculative. Consequently, the profile is limited to the confirmed facts: the aliases, the Brazilian location association, and the single ransomware event against a fuel distributor in early 2021. No additional publicly reported operations or TTP details are available for inclusion.