RECAP

April 2026

All months Next month →

1incidents investigated · 1 in Brazil

31entered active exploitation · 9 used by ransomware

17ransomware victims · 17 in Brazil

9active groups

5,838new vulnerabilities · 573 critical

What we investigated

Each case with its confidence seal and verdict — not rumors.

Grupo alega roubo de dados do Gov.br — análise indica base recicladaRecycled

Buddha · governo · 19 Apr 2026

What actually came under attack

Vulnerabilities added to CISA's KEV catalog during the month: confirmed active exploitation.

CVE-2024-27199 ⚠

JetBrains TeamCity

HIGH · 7.3 · EPSS 100%

CVE-2026-41940 ⚠

WebPros cPanel & WHM and WP2 (WordPress Squared)

CRITICAL · 9.3 · EPSS 99%

CVE-2024-1708 ⚠

ConnectWise ScreenConnect

HIGH · 8.4 · EPSS 95%

CVE-2023-27351 ⚠

PaperCut NG/MF

HIGH · 8.2 · EPSS 78%

CVE-2024-57726 ⚠

SimpleHelp SimpleHelp

CRITICAL · 9.9 · EPSS 67%

CVE-2023-21529 ⚠

Microsoft Exchange Server

HIGH · 8.8 · EPSS 62%

CVE-2024-57728 ⚠

SimpleHelp SimpleHelp

CRITICAL · 9.3 · EPSS 99%

CVE-2026-34197

Apache ActiveMQ

HIGH · 8.8 · EPSS 98%

CVE-2026-21643

Fortinet FortiClient EMS

CRITICAL · 9.1 · EPSS 94%

CVE-2024-7399

Samsung MagicINFO 9 Server

HIGH · 8.8 · EPSS 92%

CVE-2026-35616

Fortinet FortiClient EMS

CRITICAL · 9.1 · EPSS 91%

CVE-2025-29635

D-Link DIR-823X

HIGH · 7.2 · EPSS 88%

CVE-2026-1340

Ivanti Endpoint Manager Mobile (EPMM)

CRITICAL · 9.8 · EPSS 86%

CVE-2026-32202

Microsoft Windows

MEDIUM · 4.3 · EPSS 64%

CVE-2020-9715

Adobe Acrobat

HIGH · 7.8 · EPSS 49%

CVE-2009-0238

Microsoft Office

HIGH · 8.8 · EPSS 43%

CVE-2026-32201

Microsoft SharePoint Server

MEDIUM · 6.5 · EPSS 43%

CVE-2026-20133

Cisco Catalyst SD-WAN Manager

MEDIUM · 6.5 · EPSS 31%

CVE-2026-20122

Cisco Catalyst SD-WAN Manger

MEDIUM · 5.4 · EPSS 25%

CVE-2012-1854

Microsoft Visual Basic for Applications (VBA)

HIGH · 7.8 · EPSS 21%

CVE-2023-36424

Microsoft Windows

HIGH · 7.8 · EPSS 12%

CVE-2026-34621

Adobe Acrobat and Reader

HIGH · 8.6 · EPSS 7%

CVE-2026-20128

Cisco Catalyst SD-WAN Manager

Kentico Kentico Xperience

HIGH · 7.2 · EPSS 4%

CVE-2025-32975

Quest KACE Systems Management Appliance (SMA)

CRITICAL · 10.0 · EPSS 2%

CVE-2025-48700

Synacor Zimbra Collaboration Suite (ZCS)

MEDIUM · 6.1 · EPSS 2%

Who attacked most

lockbit54 (4 BR)

coinbasecartel3 (3 BR)

thegentlemen3 (3 BR)

apt732 (2 BR)

worldleaks1 (1 BR)

dragonforce1 (1 BR)

krybit1 (1 BR)

blackwater1 (1 BR)

Victims in Brazil

Organizations listed on extortion sites. Appearing there is the criminal's CLAIM, not a confirmation.

sweetome.com

lockbit5 · Retail & E-Commerce · 30 Apr 2026

lbreng.com.br

lockbit5 · Professional Services · 30 Apr 2026

sella.eng.br

apt73 · Technology · 27 Apr 2026

siapenet.gov.br

apt73 · Government & Defense · 27 Apr 2026

Colegio Notre Dame Campinas

thegentlemen · Education · 27 Apr 2026

Sea Telecom Br

coinbasecartel · Technology · 23 Apr 2026

Laboratório Santa Luzia

thegentlemen · Healthcare · 19 Apr 2026

Grupo EBD

blackwater · Professional Services · 17 Apr 2026

erstransportes.com.br

lockbit5 · Transportation/Logistics · 17 Apr 2026

Greenpharma

thegentlemen · Healthcare · 15 Apr 2026

secran.com.br

krybit · Professional Services · 14 Apr 2026

novafp.com

dragonforce · Professional Services · 14 Apr 2026

erstransportes.com.br

lockbit5 · Transportation · 14 Apr 2026

DIME Distribuidora

worldleaks · Transportation · 10 Apr 2026

Ipiranga Contábil

gunra · Professional Services · 08 Apr 2026

Correios

coinbasecartel · Transportation · 08 Apr 2026

JBS Brazil - Sample uploaded

coinbasecartel · Agriculture and Food Production · 08 Apr 2026