{"id":"CMP-202611-mrj5ei","kind":"campaign","aliases":[],"related":[],"title":"Poland's ePUAP e-government portal taken offline after a cyberattack the minister says involves foreign adversaries; expect scams posing as ePUAP","description":null,"summary":"Poland temporarily suspended its ePUAP e-government portal after a cyberattack detected this week (exact date unknown). Minister of Digital Affairs Krzysztof Gawkowski said evidence suggests foreign adversaries are involved; no actor named. Government IT teams are investigating and restoring the platform. Whether user data was taken is unknown. Reported by the minister on X and TVN24 (via Risky Bulletin, 13 Nov 2026).","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ePUAP","fixed":[]}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Messages claiming to be from ePUAP or the Polish government about the outage, account re-verification or password resets, especially links not on gov.pl domains. Specific lure text or domains: unknown.","fix":"Do not follow links in emails or SMS about ePUAP; go to the official gov.pl site directly. Organizations relying on ePUAP for filings should plan for the outage and watch for official restoration notices.","status":"open","published_at":null,"first_seen_at":"2026-11-13T09:01:34+00:00","triaged_at":"2026-11-13T09:01:34+00:00","updated_at":"2026-11-13T09:01:54+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-13T09:05:01Z","path":"unknown","entry":"unknown","reason":"The record says only that a cyberattack forced ePUAP offline and that foreign adversaries may be involved, with no account of how the attacker got in, and whether user data was taken is unknown, so the path is also unclear beyond the expected scams.","confidence":0.6}},"analyst_status":"done","analyst_note":null,"search":"'-202611':25A '13':93B '2026':95B 'actor':64B 'adversari':18A,60B 'affair':53B 'bulletin':92B 'campaign':28B 'cmp':24A 'cyberattack':12A,43B 'data':77B 'date':48B 'detect':44B 'digit':52B 'e':5A,38B 'e-govern':4A,37B 'earli':30B 'early-warn':29B 'epuap':3A,23A,27A,36B 'evid':57B 'exact':47B 'expect':19A 'foreign':17A,59B 'gawkowski':55B 'govern':6A,39B,66B 'investig':70B 'involv':16A,62B 'krzysztof':54B 'minist':14A,50B,85B 'mrj5ei':26A 'name':65B 'nov':94B 'offlin':9A 'platform':74B 'poland':1A,32B 'portal':7A,40B 'pose':21A 'report':82B 'restor':72B 'riski':91B 'said':56B 'say':15A 'scam':20A 'suggest':58B 'suspend':34B 'taken':8A,79B 'team':68B 'temporarili':33B 'tvn24':89B 'unknown':49B,81B 'user':76B 'via':90B 'warn':31B 'week':46B 'whether':75B 'x':87B","nicknames":["ePUAP attack"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["epuap","epuapattack"],"ptokens":["epuap"],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"exploitation","search_a":"'-202611':25A 'adversari':18A 'cmp':24A 'cyberattack':12A 'e':5A 'e-govern':4A 'epuap':3A,23A,27A 'expect':19A 'foreign':17A 'govern':6A 'involv':16A 'minist':14A 'mrj5ei':26A 'offlin':9A 'poland':1A 'portal':7A 'pose':21A 'say':15A 'scam':20A 'taken':8A","search_b":"'13':93B '2026':95B 'actor':64B 'adversari':60B 'affair':53B 'bulletin':92B 'campaign':28B 'cyberattack':43B 'data':77B 'date':48B 'detect':44B 'digit':52B 'e':38B 'e-govern':37B 'earli':30B 'early-warn':29B 'epuap':36B 'evid':57B 'exact':47B 'foreign':59B 'gawkowski':55B 'govern':39B,66B 'investig':70B 'involv':62B 'krzysztof':54B 'minist':50B,85B 'name':65B 'nov':94B 'platform':74B 'poland':32B 'portal':40B 'report':82B 'restor':72B 'riski':91B 'said':56B 'suggest':58B 'suspend':34B 'taken':79B 'team':68B 'temporarili':33B 'tvn24':89B 'unknown':49B,81B 'user':76B 'via':90B 'warn':31B 'week':46B 'whether':75B 'x':87B","search_c":"","cause_entry":"unknown","cause_path":"unknown","disclosures_checked_at":null,"first_public_at":"2026-11-13T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-mrj5ei","url":"https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-13T09:01:34+00:00","fetched_at":"2026-11-13T09:01:34+00:00","note":null,"cites":["https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/"]}],"documents":[{"id":144155,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3n26lk2jlbs2l","title":"@campuscodi.risky.biz: -Chinese APT uses SS7, Diameter attacks to spy on targets\n-Cyberattack takes dow","kind":"post","source":"bluesky","publisher":null,"text":"-Chinese APT uses SS7, Diameter attacks to spy on targets\n-Cyberattack takes down Poland's government platform\n-Brazil's largest port hit by cyberattack\n-Europol takes down Gootloader, CastleRAT, and StealC\n-SMS blaster arrested in Hungary\n\nN: news.risky.biz/risky-bullet...\nP: risky.biz/RBNEWS633/\nhttps://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/ https://risky.biz/RBNEWS633/\n\nlikes 3 reposts 1","published_at":"2026-11-13T08:40:06+00:00","relation":"describes","confidence":null,"note":null},{"id":144175,"url":"https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/","title":"Risky Bulletin: Chinese APT uses SS7, Diameter attacks to spy on targets","kind":"blog","source":"analyst","publisher":null,"text":"ENEA tracks SilentAir, a Chinese cyber-espionage group (linked by ENEA to Liminal Panda, cooperation unconfirmed), active since early 2025 against telcos in six countries, mostly Taiwan, and their subscribers, rarely VIPs (political figures, government officials). Plants backdoors in telco networks that send malicious SS7 and Diameter commands to collect device data, track subscriber locations and intercept calls and SMS. No IOCs given. Poland: ePUAP e-government portal temporarily suspended after a cyberattack detected this week; Minister of Digital Affairs Krzysztof Gawkowski said evidence suggests foreign adversaries are involved; investigation and restoration ongoing. Brazil: Port of Santos (Santos port authority, Sao Paulo) hit by cyberattack that began with a power outage after hackers accessed equipment exposed online, then spread through IT network; port on manual procedures for about five days; some systems (internet, telephone) restored; actor not identified (n0n extortion group hit same authority in October, 6M ransom refused). Sources: A Tribuna, World Ports, Ransomware Live.","published_at":"2026-11-13T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}