Brazil

Brazil has a lot to offer in terms of excellence. Apart from the Amazon, little is known about how actively Brazilian hackers are spying on opponents or crippling infrastructure around the world. Twenty percent of all attacks against China come from Brazil alone—by comparison, only 4.4% of all attacks against the US and Europe come from China (source: Cloudflare). This ratio fundamentally challenges the geopolitical perception of cyber threats.

While Western media reflexively point to Russia, China, or North Korea when it comes to state-sponsored hacker attacks, a completely different power is rising to prominence in the background. Latin America has the fastest growth in cyber threats worldwide — companies in the region are exposed to an average of 2,569 attacks per week in early 2025, almost 40% more than the global average. Ptsecurity The epicenter of this activity: Brazil.

More than a victim — Brazil as a player

In public debate, the country is almost exclusively portrayed as a target of attacks. According to Acronis' Cyberthreats Report H1 2025, Brazil is the second most targeted country in the world by malware, just behind India. But this victim role is only half the story.

A documented espionage campaign by the Agência Brasileira de Inteligência (ABIN) targeted Paraguayan government officials during sensitive negotiations over the Itaipu Dam — and sparked diplomatic tensions between Brazil and Paraguay. Industrial Cyber The Itaipu Dam generates 88% of Paraguay's electricity and 11% of Brazil's, with annual revenues of over $1.3 billion. The Rio Times So Brazil had tangible economic interests at stake — and ABIN provided the necessary information advantage through digital means.

Brazil's Foreign Ministry confirmed that the government under Jair Bolsonaro had authorized the espionage operations. They were only discontinued on March 27, 2023, when the new Lula da Silva administration replaced the ABIN director. 

An intelligence agency with global reach

ABIN maintains 18 offices worldwide — including in China, Russia, the US, Germany, France, Japan, and India. Grey Dynamics What is officially declared as information exchange also provides the logistical infrastructure for intelligence operations far beyond Brazil's borders.

The state intelligence service is only one aspect of the problem. Since the 2014 World Cup, Brazil has continuously expanded its use of spyware. The Bolsonaro administration significantly intensified these procurements, expanding the Brazilian intelligence system SISBIN, which brings together various agencies to share sensitive information. Brasil de Fato

Banking Trojans, botnets, organized cybercrime

Beyond the state level, Brazil has a highly developed ecosystem for cybercrime. For years, Brazil has ranked at the top of global cybercrime rankings—especially for botnets, bank fraud, and financial malware. In 2014, Kaspersky Lab ranked Brazil as the world's number one target for banking malware attacks, with nearly 300,000 users compromised. Instituto Igarapé

Brazilian organizations accounted for nearly one-fifth of all cyberattacks in the Latin American region from 2023 to 2024. Industrial Cyber Ransomware groups such as LockBit, Play, and 8Base have identified Brazilian actors as partners or sources. Up to 65% of organizations surveyed in Brazil reported ransomware attacks — a significantly higher figure than in Mexico or Colombia, at 44% each. Statista

The paradox: both attacker and victim

Brazil thus finds itself in a rarely discussed dual role: a country that is both one of the largest sources of cyberattacks and one of the most attacked nations in the world. Brazil's cyber defense capabilities within its armed forces are considered the strongest in Latin America — but internally, there is still a lack of basic infrastructure. A Brazilian security general summed it up this way: “In Brazilian institutions, the level of maturity in this regard is still very low. There are many who use systems that are not up to date — and that is a vulnerability.”

While the world looks to Beijing and Moscow, a digital power is growing in the shadow of the rainforest that plays by the same rules — only far less under observation.