Cyber Incident Victim: Tribunal de Justiça do Pará
Date:
Jan 2023
Location:
Brazil
Summary
A cyberattack targeted the Tribunal de Justiça do Pará, compromising its systems through unauthorized access using a server password. The Scientific Police's cyber forensics unit was mobilized to analyze affected computers across multiple locations, collaborating with the court's IT staff to gather details on the incident's timeline and operational disruptions. Investigators are examining whether the credentials were obtained via hacking or other means, aiming to identify the perpetrator, determine the attack methodology, and assess potential links to other cyber incidents. The forensic analysis seeks to support criminal charges and enhance understanding of the attacker's broader activities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On January 11, 2023, the Tribunal de Justiça do Pará (TJ-PA) experienced a cyberattack targeting its internal systems. The Pará State Scientific Police’s Computer Forensics Unit (GPI/PCEPA) was activated the same day at the request of the Civil Police’s Cybercrime Directorate (DECCC), following the initiation of a criminal investigation. Initial forensic activities commenced on January 13, with GPI experts conducting on-site examinations of computer systems at the TJ-PA headquarters in Belém and its auxiliary facility in Santa Izabel do Pará. Investigators collaborated with the court’s IT department staff, who provided operational details regarding the attack timeline and its disruptive effects on their infrastructure. The DECCC publicly disclosed that preliminary evidence indicated unauthorized system access occurred through compromised credentials belonging to a TJ-PA server administrator.
Forensic efforts focused on reconstructing the attacker’s methodology, including technical analysis of affected devices and interviews with the credential holder to determine whether the password was obtained through hacking or other means. The DECCC emphasized that the forensic examination aimed to establish attribution by identifying the perpetrator’s operational patterns and potential connections to other cyber incidents. While the attack caused confirmed disruptions to the TJ-PA’s IT operations, the specific nature of these disruptions and any secondary impacts on judicial services were not detailed in available reports. Law enforcement expressed confidence that the technical investigation would yield sufficient evidence for criminal charges while enhancing understanding of regional cyber threat tactics. No public statements from the TJ-PA regarding system restoration timelines or data compromise were documented during the immediate response phase.