Núclea is a Brazilian data and technology company that supports the country’s financial system by delivering digital services exclusively to banks and financial institutions. Operating in an environment where trust, availability, and data integrity are critical, the company faces a threat landscape that has evolved rapidly—particularly with the rise of AI-driven cyberattacks.
Brazil has experienced a wave of successful cyber incidents targeting financial institutions, many of them enabled by insiders or compromised credentials. The result was a noticeable shift in attacker strategy: instead of focusing on end customers, threat actors began targeting the institutions and platforms that underpin the financial ecosystem itself.
“Attacks became far more directed and contextual,” explains Guilherme, who leads incident response within Núclea’s security platform engineering team. “They weren’t noisy or obviously malicious—they were precise, patient, and designed to blend into normal operations.”
That precision was on full display in January 2026, when Núclea faced one of the most convincing phishing attacks the team had seen.
A real attack, built on trust and context
The attack began with a seemingly routine email.
It was sent from a real Brazilian government institution, using legitimate infrastructure and valid credentials that were later confirmed to have been compromised. Núclea had an established, ongoing relationship with this organization, and the email’s language, tone, and subject matter aligned perfectly with the type of communication the recipient team handled every day.
Attached to the email was a PDF document containing content that looked entirely legitimate.
The problem? A single URL embedded inside that PDF.
“The message itself was correct. The sender was real. The context was familiar. Even the document content made sense,” Guilherme explains. “There was just one small element that didn’t belong.”
That small detail was enough to initiate a full attack chain.
What the attackers were trying to do
If clicked, the URL would have downloaded a malicious payload designed to:
- Collect information about the user and device
- Identify where the system was located within the financial ecosystem
- Install remote access tools to maintain control
- Deploy an infostealer to extract sensitive data
- Execute anti-forensic scripts to erase traces of the intrusion
In other words, it was a carefully engineered operation designed for persistence and stealth, not immediate disruption.
The attack also employed urgency—a classic social engineering technique. When the link didn’t open as expected, employees requested assistance from the security team, insisting the document was important and needed to be accessed quickly.
This is precisely the kind of scenario where traditional security tools struggle: almost everything about the interaction is legitimate.
Where Darktrace made the difference
Instead of blocking the entire message or relying on known indicators of compromise, Darktrace focused on behavioral context.
Darktrace recognized:
- That the sending organization was normally trusted
- That the communication pattern matched historical behavior
- That the PDF content itself was not suspicious
But it also identified that the URL embedded within the document deviated from established behavioral patterns.
Rather than disrupting business operations, Darktrace took precise action: it rewrote the URL, preventing the malicious download while leaving the rest of the email untouched.
“When we analyzed it afterward, it became clear how dangerous the attack would have been,” says Guilherme. “But it never progressed—because Darktrace acted at exactly the right point.”
Subsequent forensic analysis confirmed the payload’s malicious intent. The attack never succeeded.
Precision over disruption
For Núclea, this incident reinforced a critical lesson: modern attacks don’t always look malicious—they hide within normal activity.
“What stands out to me is the precision,” Guilherme says. “Darktrace doesn’t rely on big, obvious signals. It’s effective in situations that fall outside the standard patterns we all know.”
Building resilience in a high trust ecosystem
For Núclea, cybersecurity is not just a defensive measure—it’s a business enabler.
Availability failures or successful breaches in the financial ecosystem can have immediate, large-scale consequences, from financial loss to reputational damage. Preventing those outcomes protects not just Núclea, but its partners and customers as well.
“Cyber resilience means keeping the business running—even under attack,” Guilherme explains. “And that requires people, processes, and technology working together.”
As AI continues to accelerate both attacks and defenses, the role of security is evolving. Precision, behavioral understanding, and intelligent automation are no longer optional—they’re essential.
“The easy days were yesterday,” Guilherme says. “The challenges ahead are bigger. We need to be prepared—internally and with partners that help us build resilience.”
.avif)
