Caliente Bandits (TA2721) is a threat group targeting finance and entertainment with Spanish-language phishing and Bandook RAT.
Caliente Bandits (TA2721) is a highly active threat group targeting finance and entertainment industries. They focus on individuals with Spanish surnames using low-volume email campaigns with Spanish-language lures to distribute the Bandook RAT and conduct reconnaissance for employee data. Key TTPs include distributing the Bandook remote access trojan, masquerading as South American companies, and using Hotmail or Gmail addresses. Defenders should monitor for Spanish-language phishing emails, Bandook RAT infections originating from unusual email domains, and signs of employee data exfiltration.
Caliente Bandits is a highly active threat group that targets multiple industries, including finance and entertainment. They distribute the Bandook remote access trojan using Spanish-language lures through low-volume email campaigns. The group primarily impacts individuals with Spanish surnames and conducts reconnaissance to obtain employee data. They masquerade as companies in South America and use Hotmail or Gmail email addresses.
They target the finance and entertainment industries.
They conduct reconnaissance.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.