In the current geopolitical landscape, cyber warfare has become a central component of conflicts and disputes between nations. States are employing offensive cyber operations for espionage, sabotage, and political influence on a global scale.
Government-coordinated attacks – often through advanced groups known as APTs (advanced persistent threats) – have evolved in sophistication and scope. This context of global cyber threats directly affects Brazil's digital security, exposing strategic sectors to significant risks and requiring responses commensurate with the technical level of adversaries.
Evolution of cyber warfare in the global scenario
In the last two decades, cyber warfare has gone from an isolated phenomenon to a global pandemic. In this turning point, there was an important milestone: the 2017 NotPetya attack, a malware with unprecedented destructive power at the time, which ushered in a new era of cyber warfare.
Since then, traditional conflicts have taken on a strong digital component: for example, the Russian campaign in Ukraine included a series of cyberattacks against electrical grids, communications, and government agencies, while hacktivist and criminal groups aligned with state interests. The integration between conventional and digital warfare has become clear, and the boundaries between state attacks and common cybercrimes have become blurred.
The main state agents of global cyber warfare include powers such as China, Russia, the United States, Iran, and North Korea, among others. Each employs specific strategies: cyber espionage for stealing industrial and government secrets, sabotage against enemy critical infrastructures, and influence attacks (such as invasions followed by leaks of confidential data to interfere in political processes). A concerning feature is the growing collaboration (or tolerance) between States and criminal groups.
Examples include ransomware gangs based in countries that do not suppress them, using financial extortion to cause strategic damage. In 2021, the ransomware attack on Colonial Pipeline in the US (attributed to a Russian-speaking group) exposed the lack of preparedness of infrastructure companies against such threats. These attacks on critical infrastructure give notoriety to the aggressors and often financial returns, making them increasingly frequent and sophisticated.
The growing influence of China
China has emerged as one of the most influential and active cyber powers. Recent reports indicate an aggressive expansion of Chinese digital espionage operations worldwide. In 2024, an average increase of 150% in intrusions carried out by hackers linked to China was observed, affecting organizations in nearly all sectors of the economy. Only in 2024, seven new Chinese cyber espionage groups have been identified, many specialized in specific sectors or technologies.
The cyber campaigns carried out by Chinese hackers have a global reach and do not spare Latin America. Research indicates that in 2023, most cyberattacks in Latin America originated from agents linked to China and Russia.
This coordinated effort reflects not only geopolitical objectives (such as monitoring diplomatic positions or foreign investments) but also economic interests. Brazil, for example, is today the largest destination for Chinese investments in Latin America, especially in energy, telecommunications, and mining. Coincidentally (or not), cyber espionage originating from China against Brazilian targets has grown in a manner similar to that observed in other regions with high Chinese investment, such as countries participating in the Belt and Road Initiative – a group that includes countries from Asia, Europe, Africa, and Latin America.
Impact of global threats in Brazil: strategic sectors under attack
Several strategic Brazilian sectors are already experiencing intrusion attempts by malicious foreign actors, whether groups supported by nations or sophisticated criminal organizations. The main vectors include targeted phishing campaigns, advanced malware embedded in critical networks, and exploitation of vulnerabilities in widely used systems.
Various installations of Brazil's critical infrastructure—such as electrical power grids, oil and gas, telecommunications, water, and transportation—have become frequent targets in cyber warfare, given their potential to cause widespread damage if compromised. In February 2021, two of the largest companies in the Brazilian electric sector suffered ransomware attacks that forced them to temporarily suspend part of their operations.
The financial sector is also not left out.North Korean groups have been showing great interest in Brazilian cryptocurrency targets, financial institutions, and even defense sectors. These criminals seek to steal digital assets to finance North Korean government programs, circumventing sanctions – it is a form of cyber warfare driven by economic motives. Furthermore, international cybercriminals (often linked to Eastern European networks) see Brazilian banks and their millions of customers as lucrative targets. Banking malware campaigns, phishing networks, and card data theft are hitting Brazil on an industrial scale. Not by chance, a recent report indicated that Brazil is the second most attacked country in the world for cybercrimes, suffering over 700 million attempts in 12 months (an average of 1,379 attacks per minute) – many of which target financial frauds.
Government and public institutions
Brazilian government institutions – including federal agencies, the Armed Forces, the Judiciary, and state governments – have become priority targets in cyber warfare, attracting espionage and sabotage attacks from various countries. Groups associated with China, Russia, and North Korea have directed operations against Brazil in recent years.
Motivation ranges from interest in diplomatic and commercial secrets to gaining strategic advantage in international negotiations. A Google report in 2023 revealed that since 2020, more than a dozen foreign cyber espionage groups have targeted users in Brazil – 85% of phishing activities attributed to governments originated from groups in China, North Korea, and Russia.
This intense activity reflects Brazil's position as a regional leader and influential actor on the global stage, making it an attractive target for adversaries seeking privileged information.
How Brazil has mitigated the risks of cyber warfare
In the face of the escalation of global cyber threats, Brazil has been adopting – and should continue to improve – various measures tomitigate risks and strengthen your cybersecurityThe lessons learned from incidents and experts' recommendations converge on some key points, such as strengthening cybersecurity governance structures – Brazil approved the National Cybersecurity Strategy (E-Ciber) in 2021, which emphasizes the need to strengthen national protection capabilities, improve international cooperation, and encourage the development of national technologies.
But there is still much to be done. The country needs to implement additional layers of defense in the energy, telecommunications, financial, transportation, sanitation, and other essential services sectors. This includes adopting international security standards (e.g., ISO 27001 standards, NIST framework) and requiring infrastructure operators to meet minimum cybersecurity requirements. It is also necessary to reduce the attack surface of these organizations, increase their resilience, and establish robust protocols for prevention, monitoring, and incident response.
In particular, the security of the backbone of the internet in Brazil should be improved – protecting data centers, large servers, exchange points, and other assets that support various critical sectors.
In the private sector, there is greater maturity, depending on the segment. The financial sector, for example, has one of the most advanced cybersecurity ecosystems in Brazil, driven by strict regulations from the Central Bank, ongoing investments in anti-fraud technology, and the need to protect high-value transactions against increasingly sophisticated threats.
In conclusion, global cyber warfare poses complex but manageable challenges for Brazil with proper planning and investments. The country has already shown progress – it is considered the most mature in cybersecurity posture in Latin America – but the pace of the threat requires constant improvement.
In the invisible theater of cyberspace, where attacks occur in microseconds, preparing in advance is essential. Strengthening Brazilian cyber resilience will not only mitigate the risks of cyber warfare but also ensure that Brazil can safely seize the opportunities of global digital transformation without having its sovereignty or strategic assets held hostage by hidden adversaries. In short, cybersecurity is national security, and it should be a priority in times of peace and conflict, today and always.