From 8c32c674cd7a96e74377585533e9ad8451ca2361 Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Thu, 11 Jan 2024 08:25:33 -0800 Subject: [PATCH] [threat-actors] Add Water Curupira --- clusters/threat-actor.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 6a4de96..f58ab0e 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -14015,6 +14015,16 @@ }, "uuid": "3decddc7-e554-48d8-8304-38b243fc9ccb", "value": "Cyber Toufan" + }, + { + "description": "With its emergence in 2022, Water Curupira has established itself as a persistent threat actor targeting organizations primarily in South America and Europe. Their modus operandi involves a combination of social engineering tactics and a diversified malware arsenal, including ransomware variants like Black Basta and credential stealers like Cobalt Strike. This multifaceted approach enables them to gain unauthorized access to victim systems, steal sensitive data, and ultimately extort victims through ransomware demands. It has been actively using Pikabot, a loader malware with similarities to Qakbot, in spam campaigns throughout 2023.", + "meta": { + "refs": [ + "https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html" + ] + }, + "uuid": "a36266ce-2374-472a-a715-13b99e38e74e", + "value": "Water Curupira" } ], "version": 297