Cyber Incident Victim: Perfil
Date:
Apr 2025
Location:
Uruguay
Summary
A hacker using the alias Gov.eth compromised the website of TV Ciudad Montevideo, defacing it with AI-generated explicit images of Uruguayan officials and leaving a threatening manifesto. This attacker, previously responsible for hacking Perfil's website where they leaked President Milei's ID and altered content with antisemitic messages, claimed access to sensitive government databases like Argentina's RENAPER and police systems. Gov.eth explicitly threatened further cyberattacks against government entities and Uruguay's Chamber of Commerce, citing political motivations against specific administrations.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On April 8, 2025, Perfil reported that a hacker using the alias Gov.eth had previously attacked its website earlier that month. During the Perfil compromise, Gov.eth accessed the Argentine Federal Police Communications System (SIFCOP) using a generic user account on April 5th at 14:18hs. Using this access, Gov.eth extracted a photo of President Javier Milei's national identity document (DNI). The attacker then defaced Perfil's digital platform, modifying the titles of existing articles to display "HACKED BY @GOV.ETH" and posting aggressive messages targeting Jewish people and President Milei, whom the hacker derogatorily referred to as "Jewlei". Gov.eth publicly claimed on Telegram to possess capabilities allowing access to sensitive government databases, specifically mentioning RENAPER (National Registry of Persons) data including DNI photos, personal details, IDARG, and PDF417 barcodes. The hacker asserted the ability to query DNI information by various identifiers like CUIT tax number, phone number, or license plate via a bot named YouBot.
Subsequently, on April 8th, Gov.eth launched another cyberattack, this time targeting TV Ciudad, a television channel in Montevideo, Uruguay. The attacker employed the same signature as the Perfil incident. Gov.eth compromised TV Ciudad's website, publishing AI-generated images depicting Uruguayan President Yamandú Orsi and Vice President Carolina Cosse partially nude, described as having poorly rendered skin and dead eyes. Alongside these images, Gov.eth posted a manifesto celebrating the attack and threatening further actions, directly warning Uruguayan government authorities that seeing themselves exposed by AI was minor compared to what was yet to come. The message also threatened the Uruguayan Chamber of Commerce, naming it as the next target if it continued "oppressing Uruguayans". Following the attack, TV Ciudad authorities reported the incident to the Montevideo Police Headquarters' Computer Crimes Unit and successfully restored their website, though the AI-generated images circulated on Reddit. Gov.eth claimed responsibility for previous attacks against Uruguayan media outlets El País and Brecha, admitted to targeting the Caja de Acción Social de San Juan, and expressed hostility towards Uruguay's ruling Frente Amplio coalition while alleging death threats received via social media and Telegram.