Ghostteam

GhostTeam is an emerging threat brand associated with the persona Zumarius and, in some defacement artifacts, the name 4wma. Public reporting in September–October 2026 documents a concentrated campaign of claims against government, health, electoral and judicial targets in Brazil, Paraguay and Argentina.

The strongest demonstrated outcome is public web defacement or publication of defacement artifacts. The actor additionally claims unauthorized administrative access and data exfiltration, including large datasets attributed to public institutions, but those breach and volume claims lack official victim confirmation in the sources reviewed.

A Brazil nexus is assessed with medium confidence from platform metadata reported by a researcher; it does not establish nationality or physical operator location. Name similarity alone does not link GhostTeam to GhostSec or Ghost Squad Hackers.

INFERENCE (confidence: medium): the September 2026 activity represents a directed regional campaign against high-visibility state functions rather than unrelated opportunistic claims. The combination of electoral, justice and health targets increases strategic and reputational sensitivity even where technical impact remains unconfirmed.