Loading threat actor…
mizanthropiaz is the handle of an individual publicly accused of compromising Brazil’s emergency alert infrastructure and sending a false nationwide-style warning to mobile phones across multiple regions. The activity is associated with unauthorized access to the Cellbroadcast-based public warning environment used by Brazilian authorities, resulting in disruption of a critical public-sector communications capability and the temporary shutdown of the national warning platform while security checks were conducted. Available reporting links the intrusion to exploitation of weak authentication and access controls, including the alleged abuse of long-exposed credentials from a government employee account. The operation demonstrated initial access against government systems and post-compromise abuse of legitimate alerting functionality to spoof an official emergency message. The known activity supports assessment of capabilities including initial access, credential theft as an enabling factor in the intrusion chain, defense-evasion through use of valid access, and spoofing of trusted public alerts. At present, high-confidence public information supports attribution only to the online persona mizanthropiaz. No corroborated evidence in the available facts establishes a broader intrusion set, sub-group structure, or state sponsorship. The observed operation appears focused on disruptive unauthorized access rather than espionage or financially motivated ransomware activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.