Researchers Uncover Brazilian Hacktivist’s Identity Who Defaced Over 4800 Sites

It’s one thing for hackers to target websites and proudly
announce it on social media platforms for all to see. It’s,
however, an entirely different thing to leave a digital trail that
leads cybersecurity researchers right to their doorsteps.

That’s exactly what happened in the case of a hacktivist under
the name of VandaTheGod, who has been attributed to a series of attacks
on government^[1]
websites since July 2019.

In a report shared with The Hacker News, researchers from Check
Point said they were able to map VandaTheGod’s activity over the
years, and eventually zero down the attacker’s real identity to a
Brazilian individual from the city of Uberlândia.

The cybersecurity firm said it notified concerned law enforcement
of its findings for further action, adding the social media
activities on profiles associated with VandaTheGod came to a halt
towards the end of 2019.

A Long Social Media Trail

VandaTheGod has a long history of going after government websites,
universities,
and healthcare providers. Notably, the attacker claimed to have
breached the database of New Zealand’s Tū Ora Compass
Health and offered medical details of one million patients for
sale on Twitter last October.

The hacker in question, allegedly part of the “Brazilian
Cyber Army” (BCA^[4]), has also vandalized
dozens of websites to spread anti-government
messages^[5], in addition to
displaying BCA’s logo in screenshots of compromised accounts and
websites.

“Many of the messages left on the defaced websites implied that
the attacks were motivated by anti-government sentiment, and were
carried out to combat social injustices that the hacker believed
were a direct result of government corruption,” the researchers
said.

What’s more, a timeline of VandaTheGod’s tweets shows that the
person enjoyed the attention from media reports mentioning the
hacking endeavors, even going to the extent of stating that “I
will stop hacking websites” once the total reaches 5,000.

“VandaTheGod didn’t just go after government websites, but also
launched attacks against public figures, universities, and even
hospitals. In one case, the attacker claimed to have access to the
medical records of 1
million patients from New Zealand, which were offered for sale
for $200,” the researchers said.
^[8]

According to Zone-H records, a
security portal that holds an archive of all web intrusions, there
are currently 4,820 entries of hacked websites linked to
VandaTheGod, most of which belongs to individuals and entities in
the United States, Australia, Netherlands, Italy, South Africa,
Canada, UK, and Germany.

Check Point said they worked by tracking down the WHOIS
information for the domain “VandaTheGod.com,” which led them to an
email address (“fathernazi@gmail.com”) that was used to register
other websites, such as “braziliancyberarmy.com.”

But what ultimately gave away VandaTheGod’s real identity were a
couple of screenshots that were uploaded to Twitter, from which the
researchers identified a Facebook profile belonging to the attacker
(“Vanda De Assis”) as well as the person’s real name — identified
only by the initials M. R.

Consequently, the researchers said they were able to identify a
number of cross-posts between the Facebook profile tied to M. R.
and that of Vanda De Assis, including photos of the individual’s
living room, proving that both the M.R. and VandaTheGod accounts
were controlled by the same individual.

“VandaTheGod succeeded in carrying out many hacking attacks, but
ultimately failed from the OPSEC perspective, as he left many
trails that led to his true identity, especially at the start of
his hacking career,” Check Point researchers concluded.

“Ultimately, we were able to connect the VandaTheGod identity
with high certainty to a specific Brazilian individual from the
city of Uberlândia, and relay our findings to law enforcement to
enable them to take further action.”

^{[2][3][6][7][9]}