Hidden Infrastructure Exposed: ANY.RUN Reveals Hijacked Gov Websites Delivering Malware

This story was originally published on HackerNoon at: https://hackernoon.com/hidden-infrastructure-exposed-anyrun-reveals-hijacked-gov-websites-delivering-malware. ANY.RUN reveals how PhantomEnigma abused compromised Brazilian government infrastructure, uncovered a new backdoor generation, and exposed hidden campaign links Check more stories related to undefined at: https://hackernoon.com/c/undefined. You can also check exclusive content about #any.run-threat-intelligence, #node.js-backdoor-electron, #government-phishing-campaign, #multimodal-threat-hunting, #phantomenigma-malware, #delphi-inno-malware-setup, #phantomenigma-banking-malware, #good-company, and more. This story was written by: @anyrun. Learn more about this writer by checking @anyrun's about page, and for more stories, please visit hackernoon.com. ANY.RUN's threat intelligence investigation reveals how the PhantomEnigma campaign leveraged compromised Brazilian government websites and email accounts to deliver malware targeting banking and public-sector organizations. The research uncovers a previously undocumented Node.js backdoor generation, links multiple attack arms through shared infrastructure and build-chain analysis, and provides detection guidance that emphasizes behavioral analysis over static indicators as the campaign continues to evolve.