Guarufilme Data Breach

Vexy Ransomware listed Guarufilme, a Brazil-based media and entertainment organization, on its leak site on October 13, 2026. Prior to this claim, credentials belonging to Guarufilme were observed circulating in criminal markets as recently as September 22, 2026. These compromised credentials spanned Google Workspace, a digital payment processor, and access to banking infrastructure, indicating a broad compromise of sensitive systems. The media and entertainment sector, along with financial services, are often targeted by ransomware groups due to the valuable data they possess and the critical nature of their operations, making them attractive targets for extortion. Vexy Ransomware typically employs a double-extortion model, exfiltrating data before encrypting systems. The group has demonstrated a recent focus on Brazilian organizations within the media, entertainment, and services sectors throughout 2026, maintaining a consistent pace of victim publications targeting companies in Latin America. The observed credentials for Guarufilme were found approximately three weeks before the ransomware group’s claim, suggesting a potential dwell period where attackers could have gained access, exfiltrated data, and prepared for encryption. This timeline aligns with typical ransomware attack methodologies.

SOCRadar’s investigation flagged guarufilme[.]com.br within sampled stealer-log data prior to Vexy Ransomware’s public claim. The analysis revealed credentials targeting three distinct systems: Google Workspace (accounts.google[.]com), identified as the primary corporate collaboration and email platform; a digital payment processor (pagamentos.grafeno[.]digital); and a banking portal (bancofibrab2c[.]b2clogin.com), which provides access to financial institutions. The most recent record of these credentials was dated September 22, 2026, a period of three weeks before the ransomware group’s public announcement. This temporal proximity between credential exposure and the ransomware claim is significant, suggesting a potential dwell time for the threat actors. The combination of compromised credentials across Google Workspace, payment processing, and banking systems represents a substantial exposure of both operational and financial data for Guarufilme, potentially enabling sophisticated attacks. This exposure profile presents two immediate risk dimensions. First, the direct financial risk associated with compromised banking and payment processor credentials, which could be exploited for fraudulent transactions independent of the ransomware incident. Second, the implication of a September dwell window, where the presence of fresh credentials three weeks prior to the leak-site listing suggests that data exfiltration may have occurred before the ransomware deployment. Consequently, a thorough forensic review should prioritize auditing logs from September 22, 2026, onward, focusing on Google Workspace audit logs, payment processor access logs, and banking authentication events from that date as critical evidence sources.