TA2725 is a threat actor known for using Brazilian banking trojans and phishing, primarily targeting Latin America and Europe.
Analyst brief
TA2725 is a threat actor tracked since March 2022, primarily targeting entities in Brazil, Mexico, and recently Spain. They leverage Brazilian banking malware alongside phishing techniques, spoofing legitimate companies like ÉSECÈ Group, using GoDaddy for redirectors and AWS, Azure, or Google Cloud for payload hosting. Defenders should focus on email security for banking trojan indicators and scrutinize downloads originating from these popular cloud hosting providers.
TA2725
unknown
TA2725 is a threat actor that has been tracked since March 2022. They primarily target organizations in Brazil and Mexico using Brazilian banking malware and phishing techniques. Recently, they have expanded their operations to also target victims in Spain and Mexico simultaneously. TA2725 typically uses GoDaddy virtual hosting for their URL redirector and hosts malicious files on legitimate cloud hosting providers like Amazon AWS, Google Cloud, or Microsoft Azure. They have been known to spoof legitimate companies, such as ÉSECÈ Group, to deceive their victims.