SecuriTricks - brazil

LegionLoader exposed!

LegionLoader, also known as Satacom, CurlyGate, and RobotDropper, is an active downloader malware that has gained significant traction recently, amassing over 2,000 samples in weeks. The campaign appears to have started on December 19, 2024, with Brazil being the most affected country. The malware …

brazil

downloader

Published: February 10, 2025

Downloadable IOCs: 108

Grandoreiro banking trojan: overview of recent versions and new tricks

Grandoreiro is a Brazilian banking trojan that has evolved into a global financial threat, targeting over 1,700 banks and 276 crypto wallets in 45 countries. Despite law enforcement efforts, the malware remains active, with new versions featuring enhanced evasion techniques like multiple Domain Gen…

Published: October 22, 2024

Downloadable IOCs: 0

Water Makara Uses Obfuscated JavaScript in Spear Phishing Campaign Targeting Brazil With Astaroth Malware

Water Makara, a threat actor group, is targeting enterprises in Brazil with a spear phishing campaign using the Astaroth banking malware. The attackers employ obfuscated JavaScript to bypass security defenses, often impersonating official tax documents to trick users. The campaign primarily affects…

domain generation algorithm

tax documents

obfuscated javascript

banking malware

Published: October 15, 2024

Downloadable IOCs: 0

AllaSenha: AllaKore variant leverages Azure cloud C2 to steal banking details in Latin America

Earlier in May, a security product detected a malicious payload aimed at stealing credentials required to access Brazilian bank accounts. The payload, named AllaSenha, is a variant of the infamous AllaKore RAT, leveraging Azure cloud infrastructure for command and control. It is specifically design…

Published: May 31, 2024

Downloadable IOCs: 61

Tag: brazil

Attack reports

LegionLoader exposed!

Grandoreiro banking trojan: overview of recent versions and new tricks

Water Makara Uses Obfuscated JavaScript in Spear Phishing Campaign Targeting Brazil With Astaroth Malware

Hadooken and K4Spreader: The 8220 Gang's Latest Arsenal

The trojan horse that wanted to fly

New banking trojan “CarnavalHeist” targets Brazil with overlay attacks

AllaSenha: AllaKore variant leverages Azure cloud C2 to steal banking details in Latin America