🇪🇨 Team Pheisito y m0z1ll4s afirman haber vulnerado portales del SENADI y su sistema de acreditación UEP, además del IEPS. Dicen retener las bases como presión y llaman a ataques de defacement. Reclamo aún no verificado por las entidades. #ciberseguridad#hacktivismo
⚠️ 🇪🇨 🏛️ 🗄️ PREVENTIVE ALERT – ALLEGED BREACH OF ECUADORIAN GOVERNMENT SYSTEMS (ACTOR: TEAM PHEISITO / M0Z1LL4S)
[STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: TEAM PHEISITO & M0Z1LL4S / DATE: NOVEMBER 7, 2026]
Centralized cyber-intelligence systems have intercepted a post—involving both an announcement and hacktivism—on underground forums (dated November 7, 2026) by an actor known as "Pheisito," representing "Team Pheisito" in collaboration with the group "m0z1ll4s." The report claims a breach of the portals belonging to SENADI (National Service for Intellectual Rights) and the UEP Accreditation body in Ecuador, while also mentioning a concurrent compromise of the IEPS (Institute of Popular and Solidarity Economy).
It is strictly noted that the veracity of this intrusion, the exfiltration of databases, and the overall authenticity of the exposed access credentials have not been officially confirmed by any Ecuadorian government institutions or incident response centers.
Threat Actor: Team Pheisito and the group m0z1ll4s.
Victims: SENADI, UEP Accreditation, and IEPS — 🇪🇨 Ecuador.
Sector: 🏛️ Government, Intellectual Property, Popular Economy, and Higher/Public Education.
Date of Publication: November 7, 2026.
Nature of the Incident: Alleged compromise of institutional servers, retention of databases for the purpose of exerting sociopolitical pressure, recruitment via messaging channels, and calls for website defacement attacks.
🛡️ PREVENTIVE TECHNICAL RECOMMENDATIONS FOR CONTAINMENT (SOC / CSIRT / GOVERNMENTAL)
Integrity Review at SENADI and IEPS: Inspect access logs and the integrity of web servers and databases at SENADI and IEPS to determine whether sensitive information was exfiltrated.
Active Monitoring of Recruitment Channels: Track activities associated with the aliases and Telegram channels used by the attackers to anticipate the potential public release of the exfiltrated data repositories.
🖥️ CENTRALIZED THREAT MONITORING SYSTEM
Intelligence System: https://t.co/wk9bZJ2Nli
Quickly check your security at: https://t.co/QZhWp0kFrO
Inquiries and services: https://t.co/sx3BM5zbnK
#Ecuador #SENADI #IEPS #Hacktivism #DataLeak #DataBreach #BreachAlert #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk
⚠️ 🇧🇷 🛡️ 🗄️ ALERT/PREVENTION – EVIDENCE OF DEFACEMENT AND CYBERATTACK AGAINST BRAZILIAN ARMY SYSTEMS
[STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: KN1GHTX1337 / BYPASSAR / DATE: NOVEMBER 6, 2026]
Centralized cyber-intelligence systems have intercepted visual evidence, posted on social media by the user "bypassar," showing the defacement of the Brazilian Army’s official institutional and military portal, sigsarex. eb. mil. br.
The message displayed on the compromised page contains political statements directed against Brazilian political parties and attributes the attack collectively to the following groups: m0z1ll4s crew, ShinyHunters, Curirica Aliance, and PheisitoTeam. Additionally, the compromised page includes download links for exfiltrated databases.
It is strictly noted that the extent of any irreversible damage to core defense infrastructure, as well as the authenticity of the exposed data repositories, has not been officially confirmed by Brazil’s military cybersecurity agencies or the national incident response center (CTIR https://t.co/uGOuMPbDEq).
Threat Actor: kn1ghtx1337
Victim / Target: A military subdomain of the Brazilian Army — 🇧🇷 Brazil.
Sector: 🛡️ National Defense, Military Infrastructure, Cybersecurity, and Government Information Technology. Registration Date: November 6, 2026.
🛡️ TECHNICAL PREVENTIVE AND CONTAINMENT RECOMMENDATIONS (SOC / CSIRT / DEFENSE)
Forensic Audit and Secure Restoration: Initiate disaster recovery protocols using air-gapped backups; do not engage in any financial negotiations or pay ransoms to the attackers.
Credential and Access Control Review: Audit all web entry points, administrative panels, and password policies to close the initial breach vectors exploited by the threat actors involved.
🖥️ CENTRALIZED THREAT MONITORING SYSTEM
Intelligence System: https://t.co/wk9bZJ2Nli
Quickly verify your security at: https://t.co/QZhWp0kFrO
Quotes and services: https://t.co/sx3BM5zbnK
#Brazil #OpCalibre22 #Defacement #MilitarySecurity #CyberAttack #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk
We attacked PT (Workers' Party) databases, obtained documents from Banco Master, compromised the records of over 10.5 million party members (+90GB), defaced military systems, and encrypted a military machine with ransomware (US$ 750).
bf: https://t.co/2DejRKelzh
#OpCalibre22
⚠️ 🇧🇷 🛡️ 🗄️ PREVENTIVE ALERT – ALLEGED BREACH OF https://t.co/f6frK59E2y AND BRAZILIAN ARMY SYSTEMS
[STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: BYPASSAR (M0Z1LL4S CREW / SHINYHUNTERS / PHEISITOTEAM) / DATE: NOVEMBER 5, 2026]
Centralized cyber-intelligence systems have intercepted a post on underground forums (made on November 5, 2026) by the threat actor "bypassar"—representing the groups M0z1ll4s Crew, ShinyHunters, and PheisitoTeam—as part of a campaign dubbed "OpCalibre22." The report claims the compromise of databases belonging to the National Directorate of the Workers' Party (PT – https://t.co/49fFpjn8Lf) in Brazil, the acquisition of confidential documents linked to Banco Master, and the exfiltration of information on over 10.5 million members via an "infostealer" (malware designed to steal data).
The actor reports a data volume exceeding 95 GB.
It is strictly noted that the veracity of this intrusion, the alleged compromise of military servers, and the overall authenticity of the exposed records have not been officially confirmed by Brazilian authorities, the political party in question, or incident response centers (such as CTIR https://t.co/uGOuMPbDEq).
Threat Actor: bypassar
Victim : Workers' Party (https://t.co/49fFpjn8Lf) and systems associated with the Brazilian Army (https://t.co/LSQvDmjoXS) — 🇧🇷 Brazil.
Sector: 🏛️ Political, Governmental, Military, and National Defense. Publication Date: November 5, 2026.
Reported Volume: Over 10.5 million member records, with a total data package of approximately 95 GB.
Nature of the Incident: Alleged large-scale, coordinated attack (involving the use of infostealers, the exfiltration of political party databases, and the encryption of military infrastructure as a form of protest).
🛡️ TECHNICAL RECOMMENDATIONS FOR PREVENTION AND CONTAINMENT (SOC / CSIRT / DEFENSE)
Forensic Audit of Political and Government Networks: Security teams at the affected entities in Brazil must immediately review access logs, identify entry points for infostealers, and verify the integrity of central servers to eliminate any persistent threats.
Mitigation of Ransomware Attacks in Military Environments: Isolate affected military network segments, verify the availability of immutable offline backups, and refuse any extortion negotiations with the groups involved.
Active Monitoring of Data Leak Channels: Track the distribution of the data samples and the 95 GB repository mentioned by the threat actor to assess the authenticity and impact of the exfiltrated data.
🖥️ CENTRALIZED THREAT MONITORING SYSTEM
Intelligence System: https://t.co/wk9bZJ2Nli
Quickly check your security status at: https://t.co/QZhWp0kFrO
Inquiries and services: https://t.co/sx3BM5zbnK
#Brazil #OpCalibre22 #PT #BrazilianArmy #DataLeak #DataBreach #BreachAlert #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk