{"id":"CMP-202611-xukjdr","kind":"campaign","aliases":[],"related":[],"title":"Brazil's largest port, Santos, hit by cyberattack: hackers got in through equipment left exposed online, caused a power outage and spread into the IT network; port on manual operations for about five days","description":null,"summary":"The Port of Santos authority (São Paulo state) was hit by a cyberattack that reportedly began with a power outage after hackers accessed equipment exposed to the internet, then spread through the IT network. The port ran on manual procedures for about five days; internet and phone have been partly restored. Start date and attacker unknown (the n0n extortion group hit the same port authority in October and was refused a $26 million ransom; no link to this attack is made). Whether data was taken is unknown. Reported by A Tribuna, World Ports and Ransomware Live (via Risky Bulletin, 13 Nov 2026).","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Port of Santos","fixed":[]}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Shippers and logistics firms using Santos: expect delays and be wary of emails about changed payment details, fees or documents claiming to be from the port authority or terminal operators. Indicators: unknown.","fix":"Confirm any payment or bank-detail change with the port authority or terminal by phone on a known number. Operators: take OT/power equipment off the internet.","status":"open","published_at":null,"first_seen_at":"2026-11-13T09:01:35+00:00","triaged_at":"2026-11-13T09:01:35+00:00","updated_at":"2026-11-13T09:01:53+00:00","category":"infrastructure","confidence":null,"triage":{"cause":{"at":"2026-11-13T09:04:58Z","path":"none","entry":"internal-exposed","reason":"The summary says the attack 'began with a power outage after hackers accessed equipment exposed to the internet, then spread through the IT network,' and the port's own disruption is described without any reported tampered install, third-party breach, stolen credentials or phishing reaching users.","confidence":0.6}},"analyst_status":"done","analyst_note":null,"search":"'-202611':36A '13':144B '2026':146B '26':116B 'access':67B 'attack':99B,123B 'author':49B,109B 'began':60B 'brazil':1A 'bulletin':143B 'campaign':41B 'caus':17A 'cmp':35A 'cyberattack':8A,57B 'data':127B 'date':97B 'day':34A,88B 'earli':43B 'early-warn':42B 'equip':13A,68B 'expos':15A,69B 'extort':103B 'five':33A,87B 'got':10A 'group':104B 'hacker':9A,66B 'hit':6A,54B,105B 'internet':72B,89B 'largest':3A 'left':14A 'link':120B 'live':140B 'made':125B 'manual':29A,83B 'million':117B 'n0n':102B 'network':26A,78B 'nov':145B 'octob':111B 'of':39A 'onlin':16A 'oper':30A 'outag':20A,64B 'part':94B 'paulo':51B 'phone':91B 'port':4A,27A,38A,46B,80B,108B,137B 'power':19A,63B 'procedur':84B 'ran':81B 'ransom':118B 'ransomwar':139B 'refus':114B 'report':59B,132B 'restor':95B 'riski':142B 'santo':5A,48B 'santos':40A 'spread':22A,74B 'start':96B 'state':52B 'são':50B 'taken':129B 'tribuna':135B 'unknown':100B,131B 'via':141B 'warn':44B 'whether':126B 'world':136B 'xukjdr':37A","nicknames":["Port of Santos attack"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["ofsantos","portofsantos","portofsantosattack"],"ptokens":["of","port","santos"],"labels":["campaign","earlywarning","infrastructure","medium"],"campaign_type":"other","search_a":"'-202611':36A 'brazil':1A 'caus':17A 'cmp':35A 'cyberattack':8A 'day':34A 'equip':13A 'expos':15A 'five':33A 'got':10A 'hacker':9A 'hit':6A 'largest':3A 'left':14A 'manual':29A 'network':26A 'of':39A 'onlin':16A 'oper':30A 'outag':20A 'port':4A,27A,38A 'power':19A 'santo':5A 'santos':40A 'spread':22A 'xukjdr':37A","search_b":"'13':144B '2026':146B '26':116B 'access':67B 'attack':99B,123B 'author':49B,109B 'began':60B 'bulletin':143B 'campaign':41B 'cyberattack':57B 'data':127B 'date':97B 'day':88B 'earli':43B 'early-warn':42B 'equip':68B 'expos':69B 'extort':103B 'five':87B 'group':104B 'hacker':66B 'hit':54B,105B 'internet':72B,89B 'link':120B 'live':140B 'made':125B 'manual':83B 'million':117B 'n0n':102B 'network':78B 'nov':145B 'octob':111B 'outag':64B 'part':94B 'paulo':51B 'phone':91B 'port':46B,80B,108B,137B 'power':63B 'procedur':84B 'ran':81B 'ransom':118B 'ransomwar':139B 'refus':114B 'report':59B,132B 'restor':95B 'riski':142B 'santo':48B 'spread':74B 'start':96B 'state':52B 'são':50B 'taken':129B 'tribuna':135B 'unknown':100B,131B 'via':141B 'warn':44B 'whether':126B 'world':136B","search_c":"","cause_entry":"internal-exposed","cause_path":"none","disclosures_checked_at":null,"first_public_at":"2026-11-13T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-xukjdr","url":"https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-13T09:01:35+00:00","fetched_at":"2026-11-13T09:01:35+00:00","note":null,"cites":["https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/"]}],"documents":[{"id":144155,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3n26lk2jlbs2l","title":"@campuscodi.risky.biz: -Chinese APT uses SS7, Diameter attacks to spy on targets\n-Cyberattack takes dow","kind":"post","source":"bluesky","publisher":null,"text":"-Chinese APT uses SS7, Diameter attacks to spy on targets\n-Cyberattack takes down Poland's government platform\n-Brazil's largest port hit by cyberattack\n-Europol takes down Gootloader, CastleRAT, and StealC\n-SMS blaster arrested in Hungary\n\nN: news.risky.biz/risky-bullet...\nP: risky.biz/RBNEWS633/\nhttps://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/ https://risky.biz/RBNEWS633/\n\nlikes 3 reposts 1","published_at":"2026-11-13T08:40:06+00:00","relation":"describes","confidence":null,"note":null},{"id":144175,"url":"https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/","title":"Risky Bulletin: Chinese APT uses SS7, Diameter attacks to spy on targets","kind":"blog","source":"analyst","publisher":null,"text":"ENEA tracks SilentAir, a Chinese cyber-espionage group (linked by ENEA to Liminal Panda, cooperation unconfirmed), active since early 2025 against telcos in six countries, mostly Taiwan, and their subscribers, rarely VIPs (political figures, government officials). Plants backdoors in telco networks that send malicious SS7 and Diameter commands to collect device data, track subscriber locations and intercept calls and SMS. No IOCs given. Poland: ePUAP e-government portal temporarily suspended after a cyberattack detected this week; Minister of Digital Affairs Krzysztof Gawkowski said evidence suggests foreign adversaries are involved; investigation and restoration ongoing. Brazil: Port of Santos (Santos port authority, Sao Paulo) hit by cyberattack that began with a power outage after hackers accessed equipment exposed online, then spread through IT network; port on manual procedures for about five days; some systems (internet, telephone) restored; actor not identified (n0n extortion group hit same authority in October, 6M ransom refused). Sources: A Tribuna, World Ports, Ransomware Live.","published_at":"2026-11-13T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}