SHADOW-WATER-063Threat actor
SHADOW-WATER-063 is a financially motivated threat actor attributed to the Banana RAT banking trojan, primarily targeting Brazilian financial accounts. Analysis of recovered artifacts, including a Python panel and PowerShell stagers, supports a moderate-confidence attribution assessment. The actor's infrastructure and endpoint telemetry indicate a focus on executing fraudulent transactions.From MISP Galaxy
Last reported 5 months ago, by Trend Micro Research1 report
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1027.016Junk Code Insertion
“Every served payload differs in variable names, function names, .NET type-name fragmentation, junk-code insertions, XOR keys, and AES-encrypted code blobs, making file-hash detection essentially impossible at population scale (Figure 5).”
- T1053.005Scheduled Task
“The script established persistence by invoking PS_ScheduledTask.ExecMethod(RegisterByUser), which registered a hidden scheduled task configured to execute powershell.exe with -WindowStyle Hidden, -ExecutionPolicy Bypass, and an encoded PowerShell command.”
- T1055Process Injection
“…or remote access trojan (RAT) that splits its capabilities across multiple Add-Type calls to build up a complex functionality like process injection, credential access, and C&C communication modules.”
- T1056.001Keylogging
“Once active, it enables operator-driven fraud through remote input control, keylogging, screen streaming, and Pix QR code interception targeting Brazilian financial institutions.”
- T1684Social Engineering
“Operator can push text popups to the victim screen (social engineering).”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud“Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud”
Indicators in its reports
named in the reports above- 162.141.111[.]227in 1 report
- hxxps://convitemundial2026[.]com/Consultar_NF-e.batin 1 report
- convitemundial2026[.]comin 1 report
- hxxp://24.199.90[.]58/payload.phpin 1 report
- 24.199.90[.]58in 1 report
- windowsk-cdn[.]comin 1 report
- c.windowsk-cdn[.]comin 1 report
- cdn[.]comin 1 report
- ecdc8fade561a75d…e90ecab1c47fin 1 report
- 38dfeb772afbd01c…23ad06e39d8fin 1 report
- 4912b1134e69ade7…44c6dfcf2ff1in 1 report
- d7545b6dacebdae2…9ba56a70cdaain 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.