⚠️ Rhadamanthys infostealer - CERT.br

We received an official notification from CERT.br, the Computer Security Incident Response Team maintained by NIC.br, about the possible exposure of student credentials due to infection by a malware called Rhadamanthys.

This virus, installed on end users' Windows computers, can capture passwords typed into forms (password fields) and send them to the attacker.

Important: this is not a failure, intrusion or internal leak in Cademí's infrastructure.

The information was collected on the infected student's machine, as determined during our technical security incident review meeting.

More details: https://status.cademi.cloud/incidents/b4gwfwpst5r3

Post-mortem

We received an official notification from CERT.br stating that credentials related to the domain of some platforms on Cademí were captured by the Rhadamanthys malware, a spyware that infects Windows computers and records passwords typed in the browser.

It is important to stress:

There was no failure, intrusion or leak in our infrastructure, systems or database. The compromise happened directly on the user's computer, which was infected with the malware. Many Brazilian domains are being notified because of the large scale of the attack.

Who is CERT.br?

CERT.br is a National CSIRT of Last Resort (Computer Security Incident Response Team), maintained by NIC.br. CERT.br helps handle incidents involving any network that uses resources administered by NIC.br (IPs or ASNs allocated to Brazil and domains under the .br ccTLD).

What this means for your operation

The captured passwords belong to users who accessed your platform while their computer was already compromised. For this reason:

Any password typed on these devices may have been intercepted, including email, social media, banking services and other systems. The password used to access the platform appears partially in the records sent by NIC.br (with masked characters, following good practice).

Required guidance for affected users

To keep everyone safe, your students must follow the actions in the right order:

1\) Before changing any password, the user must run an antivirus on the machine.

Otherwise, the new password will also be captured by the malware.

2\) After removing the virus, the user must change every password typed on the infected computer:

Email Banking services Social media Corporate systems And, only then, the platform password

This order is crucial to prevent new credentials from being compromised.

Transparency and support

We are fully cooperating with CERT.br and NIC.br and offer complete support to administrators.

If you have questions or need help with communication or procedures, we are here to help.

More information about what happened:

Shadowserver - CRITICAL: Rhadamanthys Historical Bot Infections Special Report https://www.shadowserver.org/what-we-do/network-reporting/rhadamanthys-historical-bot-infections-special-report/ Europol - End of the game for cybercrime infrastructure: 1025 servers taken down https://www.europol.europa.eu/media-press/newsroom/news/end-of-game-for-cybercrime-infrastructure-1025-servers-taken-down Operation Endgame https://operation-endgame.com/

👉 You can also check whether your email has appeared in any known breach at https://haveibeenpwned.com/.

Additional technical information about the incident (advanced)

The alert we received is part of a dataset classified as CRITICAL, sent to CERT.br through Operation Endgame, an international operation coordinated by law enforcement agencies that took down and analyzed the criminal infrastructure of the Rhadamanthys malware.

Unlike regular daily reports, this data is part of a "Special Report", a unique set of high-value information gathered after a detailed investigation that lasted several months. This kind of report is sent when authorities manage to obtain, analyze and share historical records about machines that were infected, so victims can be notified even if the infection happened in the past.

According to Shadowserver, the Rhadamanthys dataset contains information about machines compromised between 03/14/2025 and 11/11/2025.

Since the malware did not record an exact time for each event, the reports include an approximate activity window (the first and last time that computer was identified as infected). This means that:

the same user may have been infected more than once during those months; passwords may have been captured more than once; the report works as a retroactive warning, so victims can act even after the criminal infrastructure was taken down.

All events related to this operation were classified as Severity: CRITICAL, given the high risk involved and the kind of data the spyware could capture.

This information was officially shared with national CERTs and with providers responsible for networks and domains, as CERT.br did when it notified Cademí, to allow fast mitigation and communication with affected users.