Water SaciThreat actor
Water Saci is a sophisticated cyber threat actor operating in Brazil, utilizing a multi-format attack chain that includes HTA files, ZIP archives, and PDFs to bypass security measures. The campaign employs an email-based C&C infrastructure using IMAP connections to terra.com[.]br accounts, enhancing its resilience and evasion tactics.From MISP Galaxy
Last reported 5 months ago, by Elastic Security Labs3 reports
ATT&CK techniques
6 of 31 · each with the sentence it comes from- T1684Social Engineering
“…sual remote access commands, its most notable capability is a WPF-based full-screen overlay framework designed for operator-driven social engineering.”
- T1053.005Scheduled Task
“It creates a scheduled task named RuntimeOptimizeService using COM interop with the Task Scheduler (CLSID 0F87369F-A4E5-4CFC-BD3E-73E6154572DD).”
- T1056.001Keylogging
“Input Capture: Keylogging”
- T1059.005Visual Basic
“… of employing .NET binaries, the new chain leverages script-based techniques, orchestrating payload delivery through a combination of Visual Basic Script (VBS) downloaders and PowerShell (PS1) scripts.”
- T1213.005Messaging Applications
“…plementing these recommendations will help organizations and individuals better defend against malware threats delivered through messaging applications.”
- T1010Application Window Discovery
“Application Window Discovery”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook“Last year, this IP concurrently hosted a REF3076 C2 domain, a REF3076 phishing domain, and a domain previously associated with the Water Saci campaign and SORVEPOTEL/MAVERICK malware by TrendMicro (saogeraldoshiping.com).”
-
Unraveling Water Saci's New Multi-Format, AI-Enhanced Attacks Propagated via WhatsApp“Unraveling Water Saci's New Multi-Format, AI-Enhanced Attacks Propagated via WhatsApp”
-
Active Water Saci Campaign Spreading Via WhatsApp Features Multi-Vector Persistence and Sophisticated C&C“Active Water Saci Campaign Spreading Via WhatsApp Features Multi-Vector Persistence and Sophisticated C&C”
Indicators in its reports
named in the reports above- banco[.]bradescoin 1 report
- gate[.]ioin 1 report
- blockchain[.]comin 1 report
- hxxps://serverseistemasatu[.]com/data.php?recebein 1 report
- serverseistemasatu[.]comin 1 report
- sicoob.com[.]brin 1 report
- app.btgpactual[.]comin 1 report
- app.empresas.bs2[.]comin 1 report
- hxxps://miportuarios[.]com/sisti/config.phpin 1 report
- miportuarios[.]comin 1 report
- worker[.]devin 1 report
- hxxps://campanha1-api.ef971a42.workers[.]dev/api/installsin 1 report
- campanha1-api.ef971a42.workers[.]devin 1 report
- mxtestacionamentos[.]comin 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.