Ministério de Minas e Energia

Summary

An Asian cyber‑espionage group spent the past year infiltrating government and critical‑infrastructure networks in over 37 countries, compromising 70 organisations including law‑enforcement agencies, finance ministries, a parliament and a senior official. Using tailored phishing emails and unpatched vulnerabilities, the attackers accessed email servers, exfiltrated sensitive data on communications, financial dealings, military and diplomatic matters, and remained undetected for months. Among the victims was Brazil’s Ministry of Mines and Energy, a key rare‑earth mineral supplier, which was notified by the security firm that discovered the campaign and offered assistance. The US Cybersecurity and Infrastructure Security Agency acknowledged the activity and is working with partners to mitigate the exploited vulnerabilities.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The Ministry of Mines and Energy of Brazil was identified as one of the victims of a cyber‑espionage campaign conducted by an Asian state‑aligned group, according to a research report published by Palo Alto Networks on 5 February 2026. The report states that the group successfully compromised the ministry’s networks, which oversee a major supply base of rare earth mineral reserves. The attackers used highly‑targeted, tailored fake emails and exploited known, unpatched security flaws to gain initial access. Once inside, they were able to spy on email communications and exfiltrate sensitive data from the ministry’s email servers. An official at the ministry, speaking on condition of anonymity, said that the ministry had not identified the attack before being notified by the security firm.

The same campaign targeted government and critical‑infrastructure entities in more than thirty‑seven countries, compromising the networks of about seventy organisations, including five national law‑enforcement and border‑control agencies, three ministries of finance, a national parliament and a senior elected official in another state. The attackers collected information on diplomatic matters, financial dealings, military and police operations, and geopolitical events such as trade negotiations and political unrest. Palo Alto Networks reported that it notified all identified victims, offered them assistance, and included some of their names in the public report—an unusual step for a cyber‑security company. The United States Cybersecurity and Infrastructure Security Agency confirmed awareness of the intrusion campaign and said it was working with international partners to address the exploited vulnerabilities.

The ministry was among the victims identified in the report describing a year‑long espionage campaign. The report notes that the hacking activity coincided with various geopolitical developments; for example, in October 2025 United States diplomats held meetings with Brazilian mining executives. The group’s operations were also observed in countries such as the Czech Republic, Germany, Poland, Greece, Italy, Cyprus, Indonesia, Malaysia, Mongolia, Panama and others, where they conducted reconnaissance on governmental institutions. Although the ministry’s official stated it had not detected the breach, the security firm’s findings indicate that data exfiltration occurred.

Sources

Sources available to members: 1 source.