SHADOW-WATER-063 is a financially motivated threat actor that emerged in early 2026, identified as the operator of the Banana RAT banking trojan. This group is assessed with high confidence to be Brazilian, given their exclusive targeting of Brazilian financial institutions and the use of Brazilian Portuguese in recovered server-side tooling. Their primary motivation is financial fraud, specifically executing fraudulent transactions against corporate and individual financial accounts. What distinguishes SHADOW-WATER-063 from other groups is their highly focused targeting on 16 specific Brazilian banks and cryptocurrency exchanges, combined with a unique Pix QR interception subsystem tailored for the Brazilian instant payment system. The group also utilizes a Malware-as-a-Service (MaaS) style platform for polymorphic payload generation, which helps in evading detection. While tracked as SHADOW-WATER-063 by TrendAI, the malware itself is known as Banana RAT, and a related family has been

Actores similares

shadowbyt3actor · 13blackwaterransomware · 11blackshadowransomware · 2shadowactor · 2shadowbyt3sactor · 2apolloshadowactor · 1clearwateractor · 1shadowbyt3$actor · 1MuddyWaterapt · 1ShadowByt3$ransomware · 1