shadow-water-063

Executive Summary

Shadow‑Water‑063 is a financially-driven actor group operating primarily in Brazil, deploying the Banana RAT banking trojan to execute fraudulent invoice payments and credential theft across 16 major banks. Their toolkit blends polymorphic malware, public‑cloud exfiltration, email‑account abuse, and denial‑of‑service attacks to evade detection and disrupt services. The group demonstrates sophisticated persistence via cloud images and service hijacking, while actively targeting MFA mechanisms.

Goals & Targeting

Shadow‑Water‑063’s strategic objectives are clear: maximize financial gain by exploiting Brazil’s banking infrastructure while maintaining operational stealth. By targeting a curated list of 16 banks, the actor leverages automated credential harvesting to broaden reach and reduce manual effort. The persistence mechanisms focused on cloud images and service binaries indicate an intent for long‑term footholds, enabling repeated fraud cycles and revenue generation. The group also demonstrates a willingness to employ denial‑of‑service tactics and MFA bypass techniques to mitigate detection risk and maintain continuity of operations, underscoring a highly methodical approach that balances impact with survivability.

Key Capabilities

• Banking fraud via fake invoices targeting Brazilian banks
• Credential harvesting from email services (Exchange, Office 365, Google Workspace)
• Creation of operational email and cloud storage accounts
• Exfiltration over public cloud storage providers (Dropbox, MEGA, OneDrive, AWS S3)
• Denial-of-service attacks on web, DNS, and application endpoints
• Remote service exploitation for lateral movement within victim networks
• Automated credential searches using tools like MailSniper
• Service binary hijacking through misconfigured file permissions
• Persistence via malicious code in cloud or container images
• Spoofed HTTP User-Agent headers to blend with legitimate traffic
• Targeting and bypassing multi-factor authentication mechanisms
• Polymorphic or mutating malware for signature evasion

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Shadow‑Water‑063’s operations reveal a focused but high‑profile campaign against Brazilian financial institutions, beginning with the deployment of Banana RAT and rapid expansion into credential harvesting via new email and cloud‑storage accounts. The actor stages data exfiltration through public services such as Dropbox and OneDrive while simultaneously launching Denial‑of‑Service attacks to distract or extort victims during lateral movement phases. Polymorphic payloads, service binary hijacking, and persistence in cloud images enable the threat actor to maintain long‑term footholds and repeat fraudulent transactions. Historically, these operations have targeted 16 major banks and crypto exchanges, demonstrating efficient automation with tools like MailSniper for credential discovery. The group's operational tempo is aggressive yet carefully staged to avoid detection. While primarily confined to Brazil, there are indications that Shadow‑Water‑063 may diversify its infrastructure or victim scope in the future, though concrete evidence remains limited.

IOC Patterns

• Public Cloud Storage Exfiltration
• Email Account Creation Abuse
• Credential Harvesting via MailSniper
• Service Binary Hijacking through Permission Misconfiguration
• Malicious Cloud Image Persistence
• HTTP User-Agent Spoofing
• Network DoS Traffic
• Polymorphic Malware Signatures

Recommended Actions

• Enforce multi‑factor authentication across all employee accounts.
• Monitor and restrict the creation of new email and cloud storage accounts, flagging suspicious activity.
• Patch public‑facing applications promptly and harden firewall rules to detect/block DoS traffic.
• Deploy intrusion detection/prevention systems tuned to detect credential‑harvesting tools such as MailSniper.
• Inspect outbound traffic for exfiltration over public cloud storage services (Dropbox, MEGA, OneDrive, AWS S3).
• Conduct regular phishing awareness training and simulated attacks.
• Harden Windows service binary permissions to prevent hijacking of service executables.

Suggested Tags