SHADOW-WATER-063

Also known as: SHADOW-WATER-063

SHADOW-WATER-063 is a financially motivated threat actor attributed to the Banana RAT banking trojan, primarily targeting Brazilian financial accounts. Analysis of recovered artifacts, including a Python panel and PowerShell stagers, supports a moderate-confidence attribution assessment. The actor’s infrastructure and endpoint telemetry indicate a focus on executing fraudulent transactions. Key evidentiary pillars establish their intent to exploit Brazilian financial systems.

🌍 Country Brazil

Introduction

SHADOW-WATER-063 is a financially motivated threat actor attributed to the Banana RAT banking trojan, primarily targeting Brazilian financial accounts. Analysis of recovered artifacts, including a Python panel and PowerShell stagers, supports a moderate-confidence attribution assessment. The actor’s infrastructure and endpoint telemetry indicate a focus on executing fraudulent transactions. Key evidentiary pillars establish their intent to exploit Brazilian financial systems.

Activities and Tactics

Country of Origin: 🇧🇷 Brazil

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • PowerDuke:
  • POWERSTATS:
  • Power Loader:
  • Trojan.Karagany:
  • POWERSOURCE:
  • Trojan.Mebromi:
  • Xploit:
  • PowerRAT:

Attribution and Evidence

Country of Origin: Brazil Additional attribution information pending cataloguing.

References

References pending cataloguing.