Digital risk: 314 billion malicious activities are detected in Brazil, in the 1st half of 2025

A Fortinet, a global cybersecurity company, identified 314.8 billion malicious activities directed to Brazil in the first half of 2025. The data integrates the Global Threat Scenario report, prepared by FortiGuard Labs, the company's threat intelligence laboratory. The survey analyzed cyber behavior in Latin America and Canada in the period, detecting more than 374 billion attack attempts 84% of which were directed to Brazil. To a lesser extent, Mexico (10.8%), Colombia (1.89%) and Chile (103T of the countries reached).

The presentation of the report took place during the Fortinet Cybersecurity Summit Brazil 2025 (FCS 2025), one of the largest cybersecurity events in Latin America. At the time, it was revealed that Brazil also concentrated 41.9 million malwares distribution activities 4 software designed to cause damage or gain unauthorized access to computer systems 52 million actions related to botnets, which can allow remote control of infected devices.

“By presenting the main cyber threat data from Latin America and Canada at FCS 2025, we reinforce our commitment to transparency, collaboration and market preparation in the face of digital risks. Turning data into strategic knowledge is the first step to creating a more mature and effective security culture in Brazil”, comments Frederico Tostes, Country Manager Fortinet Brazil.

The study considers the cyber destruction chain model, which analyzes each step of an attack 2 billion recognition to final execution. In Brazil, the main vectors detected include 1 billion attacks by brute force and 2.4 billion attempts to exploit vulnerabilities.In the recognition phase, 2 billion active checks were detected. In the delivery, 4 million attempts to drive-by download (unintentional download of software) and 662 thousand malicious files of the office type. 

In the installation stage, 12 million Trojans stand out, malware that disguises itself as legitimate software to deceive the user, and 67 thousand attempts at unauthorized mining of cryptocurrencies (CryptoMiner). In the final phase, of action and objectives, the country recorded 309 billion attempts at denial of service (DDoS) and 28.1 thousand incidents of ransomware malware that encrypts the victim's data and demands a ransom to restore access.

According to Alexandre Bonatti, VP of Engineering at Fortinet Brazil, another highlight of the report is the focus of threats in the impact phase. “In Brazil, 98,11% of the identified malicious activities are directly linked to final impact actions. Only 1,01% correspond to the initial access stage. This indicates a scenario of increasingly targeted, rapid and focused attacks on interruption or extortion. In this scenario, attention should not be only on avoiding the attack, but how to respond and quickly contain its effects”, analyzes the executive.

Frederico Tostes comments that the increasing complexity and volume of attacks reinforce the urgency of integrated, proactive and continuous cybersecurity strategies. “As we release this report during FCS 2025, we reiterate Fortinet's commitment to supporting companies and institutions in protecting their digital assets, based on global intelligence and state-of-the-art technology”.

Fortinet structures its threat intelligence operations from a continuous cycle composed of six steps: targeting, collection, processing, analysis, dissemination and feedback.This approach ensures fast and sustained responses to emerging threats, with real-time updates to its systems and customers.