# APT73 claims compromise of Brazilian government domain

Published: 2026-06-23 · Severity: routine · Sectors: government-national
Canonical: https://vorant.io/reports/14ff5cf5-de1b-51b4-9530-c865f5761a13/apt73-claims-compromise-of-brazilian-government-domain

> APT73 ransomware group claims to have compromised a gov.br domain with 106 exposed user credentials.

Ransomware.live, a platform that indexes publicly visible ransomware disclosures, reports that APT73 has claimed compromise of a Brazilian government (gov.br) domain. The actor reports 106 compromised users, 14 third-party employee credentials, and 17 items of external attack surface exposure. No active exploitation details or technical indicators are provided in the public disclosure. This represents a claimed intrusion against a national government entity, though verification status and actual impact remain unclear from the indexed information alone.

## Mentioned in this report

- Threat actors: APT73
- Malware: APT73

Source reporting: https://www.ransomware.live/id/Z292LmJyQGFwdDcz

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/14ff5cf5-de1b-51b4-9530-c865f5761a13/apt73-claims-compromise-of-brazilian-government-domain.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup