Hackers Hijack Government Websites to Deliver Malware via Trusted Links

Key Takeaways

• A sophisticated threat actor is leveraging compromised Brazilian government websites to distribute the PhantomEnigma malware.
• The campaign employs both direct malware delivery and QR-code phishing (quishing) tactics, impersonating official law enforcement documents.
• The attackers frequently rotate command-and-control infrastructure, making traditional domain-based blocking ineffective.
• The malware’s unique Delphi/Inno Setup and Node.js/Electron build chain serves as a consistent identifier across various samples.

Attackers Exploit Government Infrastructure to Spread PhantomEnigma Malware

A persistent threat actor has been observed weaponizing legitimate Brazilian government websites to disseminate the PhantomEnigma malware, according to recent analysis. This multi-pronged campaign also incorporates QR-code phishing, or “quishing,” tactics, further complicating detection and mitigation efforts.

Coordinated Malicious Operations

Security researchers have identified a clear connection between the PhantomEnigma malware distribution and a distinct QR-code phishing operation. The quishing scheme utilizes deceptive “Ofício Polícia Civil” PDF documents, designed to appear as official communications from the Civil Police. Evidence strongly suggests these are two facets of a single, coordinated attack.

Multiple compromised government domains, including protocolo.sorocaba.sp.gov[.]br and prodoc.ap.gov[.]br, were found to host both the fake “Ofício-PC” content and the PhantomEnigma installers. This shared infrastructure usage solidifies the assessment that a unified threat actor is behind both operations.

Evolving Infrastructure and Detection Challenges

The attackers employ a highly dynamic approach to their command-and-control (C2) infrastructure, with domains and IP addresses rotating almost weekly. This rapid turnover renders static blocklists largely ineffective. For instance, the domain policiacivilmg[.]com, often cited as a primary seed, appeared in only 15% of 231 analyzed sandbox sessions. This highlights a critical challenge: relying solely on domain-based detection methods would miss approximately two-thirds of the malicious activity.

Despite the constantly changing network infrastructure, a consistent “fingerprint” of the malware has emerged. The recurring build chain, utilizing Delphi/Inno Setup and Node.js/Electron, proved to be the most reliable identifier, successfully linking all 231 related sessions even as the underlying C2 infrastructure shifted.

Impact and Mitigation Difficulties

The use of trusted government infrastructure poses significant risks. Nearly one-third of the malicious samples initially received clean verdicts from automated security tools, leading to delayed containment. The potential consequences of these compromises include banking fraud, exposure of sensitive data, operational disruptions for affected entities, and increased incident response costs.

Security teams face a unique dilemma when dealing with compromised .gov.br and .jus.br hosts. Unlike attacker-owned infrastructure, these legitimate government domains cannot be simply blocked outright without risking the disruption of essential public services. A more nuanced approach is required.

What You Should Do

• Implement advanced behavioral analysis in sandbox environments to identify malware characteristics beyond static indicators.
• Utilize YARA rules to detect the specific Delphi/Inno Setup and Node.js/Electron build chain associated with PhantomEnigma.
• Integrate continuously updated threat intelligence feeds to track the evolving C2 infrastructure and new attack vectors.
• Educate users about the risks of QR-code phishing and the importance of verifying the legitimacy of official-looking documents, especially those delivered via unexpected channels.
• Develop incident response plans specifically tailored for handling compromises of trusted government infrastructure, balancing containment with service continuity.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.