Water Curupira is a persistent threat actor known for Black Basta ransomware and Pikabot loader campaigns.
Analyst brief
Water Curupira is a persistent threat actor that emerged in 2022, primarily targeting organizations in South America and Europe. It uses social engineering tactics and a diverse malware arsenal, including Black Basta ransomware and Cobalt Strike, to gain access, steal data, and extort victims. Throughout 2023, it actively employed the Pikabot loader, which shares similarities with Qakbot, in spam campaigns. Defenders should focus on detecting phishing emails, monitoring for Pikabot-specific TTPs, and scrutinizing the network for Cobalt Strike C2 connections.
Water Curupira
unknown
With its emergence in 2022, Water Curupira has established itself as a persistent threat actor targeting organizations primarily in South America and Europe. Their modus operandi involves a combination of social engineering tactics and a diversified malware arsenal, including ransomware variants like Black Basta and credential stealers like Cobalt Strike. This multifaceted approach enables them to gain unauthorized access to victim systems, steal sensitive data, and ultimately extort victims through ransomware demands. It has been actively using Pikabot, a loader malware with similarities to Qakbot, in spam campaigns throughout 2023.