Tag: guildma

2 Attack Reports | 0 Vulnerabilities

Attack reports

Inside Banana RAT: From Build Server to Banking Fraud

An MDR investigation successfully mapped the complete operational infrastructure of Banana RAT, a Brazilian banking trojan operated by threat cluster SHADOW-WATER-063. The investigation uncovered both server-side and client-side components, revealing a sophisticated FastAPI-based polymorphic payloa…
powershell
financial fraud
casbaneiro
grandoreiro
mekotio
guildma
2026-05-19
banana rat
brazilian banking trojan
chavecloak
fastapi
pix qr interception
polymorphic payload
tetrade
Published: May 19, 2026
Downloadable IOCs: 8

Remote Monitoring and Management (RMM) Tooling Increasingly an Attacker's First Choice

Threat actors are increasingly using legitimate remote monitoring and management (RMM) tools as initial payloads in email campaigns. This trend aligns with a decrease in the use of traditional loaders and botnets by initial access brokers. RMMs can be exploited for data collection, financial theft,…
screenconnect
rmm
remcos
lumma stealer
asyncrat
remote access
cybercrime
grandoreiro
email campaigns
netsupport
astaroth
initial access
2025-03-12
guildma
atera
mispadu
bluetrait
fleetdeck
Published: March 12, 2025
Downloadable IOCs: 15
Click here to see more Attack Reports