---
id: "CMP-202611-xukjdr"
page: "https://infrastack.ai/live/CMP-202611-xukjdr"
kind: "campaign"
aliases: []
title: "Brazil's largest port, Santos, hit by cyberattack: hackers got in through equipment left exposed online, caused a power outage and spread into the IT network; port on manual operations for about five days"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Port of Santos", "fixed": []}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-13T09:01:35+00:00"
updated_at: "2026-11-13T09:01:53+00:00"
sources: [{"source": "analyst", "url": "https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/", "first_seen_at": "2026-11-13T09:01:35+00:00", "cites": ["https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/"]}]
exploit_sources: []
---

# Brazil's largest port, Santos, hit by cyberattack: hackers got in through equipment left exposed online, caused a power outage and spread into the IT network; port on manual operations for about five days

Link for people: https://infrastack.ai/live/CMP-202611-xukjdr (this .md is for agents)

The Port of Santos authority (São Paulo state) was hit by a cyberattack that reportedly began with a power outage after hackers accessed equipment exposed to the internet, then spread through the IT network. The port ran on manual procedures for about five days; internet and phone have been partly restored. Start date and attacker unknown (the n0n extortion group hit the same port authority in October and was refused a $26 million ransom; no link to this attack is made). Whether data was taken is unknown. Reported by A Tribuna, World Ports and Ransomware Live (via Risky Bulletin, 13 Nov 2026).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Port of Santos affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: an internal system reachable from the internet (internal-exposed). The summary says the attack 'began with a power outage after hackers accessed equipment exposed to the internet, then spread through the IT network,' and the port's own disruption is described without any reported tampered install, third-party breach, stolen credentials or phishing reaching users.

How it reached others: it stayed inside (none).

So it does not happen to you: List internal apps with a public hostname and check none still accepts a development or default credential; make sure test environments cannot reach production.

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/breaches.md#internal-exposed

## How to check

Shippers and logistics firms using Santos: expect delays and be wary of emails about changed payment details, fees or documents claiming to be from the port authority or terminal operators. Indicators: unknown.

## Fix

Confirm any payment or bank-detail change with the port authority or terminal by phone on a known number. Operators: take OT/power equipment off the internet.

## Timeline

- 2026-11-13T09:01:35+00:00 analyst https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/

## Documents

- [describes] @campuscodi.risky.biz: -Chinese APT uses SS7, Diameter attacks to spy on targets
-Cyberattack takes dow https://bsky.app/profile/campuscodi.risky.biz/post/3n26lk2jlbs2l
- [describes] Risky Bulletin: Chinese APT uses SS7, Diameter attacks to spy on targets https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_