THREAT WATCH · September 28, 2026 · RANSOMWARE LISTING

Brazilian Services Firm camorim.com.br Listed by LOCKBIT5

A services-sector organization in Brazil, identified by the domain camorim.com.br, was recorded on the LOCKBIT5 ransomware tracker on September 28, 2026. The company employs between 51 and 100 people. As of the listing date, no public statement or disclosure from the organization has been observed. A listing on a ransomware tracker is a strong signal of compromise but does not by itself confirm that data was exfiltrated or that the company has acknowledged an incident.

Key takeaways

• camorim.com.br was recorded on the LOCKBIT5 tracker on September 28, 2026.
• The organization operates in the services sector in Brazil with 51-100 employees.
• No public disclosure from the company has been observed as of the listing date.
• LOCKBIT5 continues to add new listings at a steady pace across multiple sectors.

What Intel128 Recorded

• The domain camorim.com.br appeared on the LOCKBIT5 leak tracker on September 28, 2026.
• The organization is based in Brazil and operates in the services sector.
• Company size is estimated at 51-100 employees.
• No public disclosure from the company was found at the time of recording.

About the Threat Actor

LOCKBIT5 is a ransomware group that operates a public leak site where it posts the names and domains of organizations it claims to have compromised. The group has been active since 2024 and has listed hundreds of organizations across multiple countries and sectors. A listing on the tracker means the group has published the organization's name, which typically follows a period of negotiation or a deadline set by the attackers. It does not confirm that the company paid a ransom or that specific data was stolen.

What This Means for camorim.com.br

The listing is a public signal that the organization may have been targeted by LOCKBIT5. Companies of this size - between 51 and 100 employees - are often attractive targets because they may have fewer dedicated security resources than larger enterprises while still holding data that attackers consider valuable. The services sector is broad and includes many sub-industries, so the specific risk profile depends on what data the organization holds and how its network is structured.

Recommended Actions

• Check for indicators of compromise. Organizations in the same sector or region should review their own environments for signs of LOCKBIT5 activity, including unusual outbound connections, new scheduled tasks, or encrypted file patterns.
• Review third-party exposure. If camorim.com.br provides services to other companies, those downstream partners should assess whether their own data could be affected.
• Monitor for further disclosure. A listing without a public statement from the company may be followed by additional posts on the tracker or by a formal disclosure in the coming days or weeks.
• Update incident response plans. Even if this specific organization is not in your supply chain, the listing is a reminder that LOCKBIT5 is actively targeting mid-sized service providers in Brazil and elsewhere.

Context

LOCKBIT5 listings have appeared across a wide range of sectors and geographies. The group's activity level in 2026 remains consistent with its pattern since 2024. Brazil continues to see a steady flow of ransomware listings, reflecting both the size of its digital economy and the operational focus of several active groups. Intel128 will update this entry if further information becomes available.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.