IOC Radar
TLP:WHITE68 IOCs

Hidden Infrastructure Exposed: ANY.RUN Reveals Hijacked Gov Websites Delivering Malware

AC
ANY.RUN Cybersecurity Blog
Published July 16, 2026Original Report

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREportaldrh.tjba.jus.brhttps://zsxocjarsate.…https://protocolo.sor…CAPABILITYCobalt StrikeStealcVICTIMunknown
Adversary
Infrastructure(6)
Capability(2)
Victim

5W+H Threat Analysis

Analysis unavailable

Indicators of Compromise

Indicators of Compromise68

TypeIndicatorConfidenceScoreFirst Seen
Domainportaldrh.tjba.jus.br
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://zsxocjarsate.com/nbw/
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://protocolo.sorocaba.sp.gov.br/protocolo/signkit.jsp?yd=5F8bz2Lapfi%2Bf41ZRmsNAtfvOls6zkkpOSPYO4UqALf0x8Hv%2BZcPRgcBznBl0tH&nbsp;&nbsp;</li>
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://url.de.m.mimecastprotect.com/s/cFJoCr2PqncDzNRl7U7fmf4fQ3q?domain=camaraparaguacu.sp.gov.br&nbsp;&nbsp;</li>
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://www.funrespol.pc.ro.gov.br/procedimento/aQbax7Lq4R&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
SHA256e0dae1a04b7a3b2ae07377b0fd00681e9633532788870b3709a9e149f3ccf0e0
botnetfile-hashintel-blog
High
86
Jul 9, 26
IP158.94.208.120
intel-blogmalwarenetwork
High
58
Jul 16, 26
IP91.92.241.181
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://circ.rs.gov.br/OficioDigital.exe&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://marapoama.sp.gov.br/doc/4h7Bae/Mn9K3N&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://ferrazdevasconcelos.sp.gov.br/down.php&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://camaraparaguacu.sp.gov.br/doc/naNXNW0tQ7&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://camaraparaguacu.sp.gov.br/doc&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://poa.sp.gov.br/oficio/anexo/VQC7WEcf&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domaindahieenloo.com
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://condemat.sp.gov.br/certificate/APL3SJ9e/723406349/&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
IP79.110.49.32
intel-blogloadermalware
High
58
Jul 16, 26
URLhttps://poa.sp.gov.br/download/7552PRc3/544840142/&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainloginam.sesp.es.gov.br
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://poa.sp.gov.br/documento/3QFKMM71/527058494/&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainpsznaoehteeh.com
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://camaraparaguacu.sp.gov.br/doc/wsVPWyP0iL&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
IP195.177.94.103
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://poa.sp.gov.br/doc/wBvCEwP3tO/oSKmMKG1sw&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainfunrespol.pc.ro.gov.br
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://camaraparaguacu.sp.gov.br/doc/R0RU5TEpc2&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://camaraparaguacu.sp.gov.br/doc/i00hqHrGFr&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://camaradelassance.mg.gov.br
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://www.pinhalgrande.rs.gov.br/down.php&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainoficiospolicia.com
data exfiltrationdata store exposureexploitation activity
High
83
Mar 18, 26
IP185.219.83.191
c2intel-blogmalware
High
58
Jul 16, 26
URLhttps://marapoama.sp.gov.br/levantamento/M5nkwP/dM0CgC&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://camaraparaguacu.sp.gov.br/doc/DcUXKm/S7q88t&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
SHA25671f69978667dc421e7edf8885e9f3bde9dd527d9f7974228c9a6eac84c2ab71c
file-hashintel-blogmalware
Medium
53
Jul 16, 26
Domaincompromised.gov.br
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainnovoservidor2026.com
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://marapoama.sp.gov.br/oficio/LA9ks3d/ldo9JodAS/vYnerL/fkeA5r&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainpinhalgrande.rs.gov.br
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainzabbxsoftware.com
c2intel-blogloader
High
58
Jul 16, 26
URLhttps://marapoama.sp.gov.br/documento/L5fHnY/d13mLf&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domaintimon.ma.gov.br
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://camaraparaguacu.sp.gov.br/oficio/mGeI1KrXIT&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainpccvioo.com
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://protocolo.sorocaba.sp.gov.br/protocolo/kitsigns.jsp?yd=DtmcOmPD4GdPF9H06LU6tVN8lm2467QxWGDEOmFL0qWjScIylunV8re%2B0cZMiJ6O&nbsp;&nbsp;</li>
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainareal.rj.gov.br
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainpoliciacivil.pe.gov.br
exploitintel-blogmalware
High
58
Jul 16, 26
IP188.137.246.189
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://camaraparaguacu.sp.gov.br/doc/DzAe8Sxvca&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
SHA118576cf8abd7812271cef15c8c401c7207caa231
file-hashintel-blogmalware
Medium
53
Jul 16, 26
URLhttps://lontra.mg.gov.br/arquivo.php&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://poa.sp.gov.br/doc/k9l00oFolA/4mZKTCE4ex&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainkak.is
aptespionageindicator
High
73
Dec 29, 25
Domaintaaeiuep.com
botnetintel-blogmalware
High
86
Jun 26, 26
Domainpccvill.com
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domaingov.br
exploitindicatorintel-blog
Low
31
May 28, 26
URLhttps://floresdegoias.go.gov.br/levantamento/v6aq7x/prm9yG&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
IP45.141.119.188
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainlogs.zabbxsoftware.com
c2intel-blogloader
High
58
Jul 16, 26
URLhttps://poa.sp.gov.br/doc/KhDvexT9QX/t4iVaErskj&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainoauth.openvpnet.com
c2intel-blogloader
High
58
Jul 16, 26
Domainseplag.mt.gov.br
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainpoliciacivilmg.com
intel-blogmalwarenetwork
High
58
Jul 16, 26
SHA1a9e499076e60cd525b23d7c667f1929bc0a9b294
file-hashintel-blogmalware
Medium
53
Jul 16, 26
Domaineeresofeuae.com
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainprodoc.ap.gov.br
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://camaraparaguacu.sp.gov.br/doc/js.brnUl8Z&nbsp;&nbsp;
intel-blogmalwarenetwork
High
58
Jul 16, 26
URLhttps://arcese.urlsand.com/?u=https%3A%2F%2Fcamaraparaguacu.sp.gov.br%2Foficio%2Fx2eDBGceCF&amp;e=dd4b7717&amp;h=be3cf1fa&amp;f=y&amp;p=y&amp;m=4gql0c4CXBz334D&nbsp;&nbsp;</li>
intel-blogmalwarenetwork
High
58
Jul 16, 26
Domainaplicacao.cbm.mt.gov.br
intel-blogmalwarenetwork
High
58
Jul 16, 26

IOC Relationship Graph

IOC Relationship Graph68 total IOCs
DomainURLSHA256IPSHA1
URL32Domain25IP7SHA2562SHA12Malware2REPORTHidden Infrastructure ExpoCobalt StrikeStealc
scroll to zoom · drag to pan · click IOC to open