SHADOW-WATER-063 is a financially motivated threat actor using Banana RAT to target Brazilian financial accounts.
Analyst brief
SHADOW-WATER-063 is a financially motivated threat actor attributed to the Banana RAT banking trojan, primarily targeting Brazilian financial accounts. The actor uses a Python panel and PowerShell stagers to execute fraudulent transactions. Defenders should focus on monitoring PowerShell script execution anomalies and inspecting network traffic for suspicious C2 communications associated with Brazilian financial systems.
SHADOW-WATER-063
unknown
SHADOW-WATER-063 is a financially motivated threat actor attributed to the Banana RAT banking trojan, primarily targeting Brazilian financial accounts. Analysis of recovered artifacts, including a Python panel and PowerShell stagers, supports a moderate-confidence attribution assessment. The actor's infrastructure and endpoint telemetry indicate a focus on executing fraudulent transactions. Key evidentiary pillars establish their intent to exploit Brazilian financial systems.