Full Report
Este informe ofrece una visión general de las tendencias y desarrollos en el ecosistema cibercriminal de América Latina y el Caribe (LAC) en 2025.
Analysis Summary
This summary covers the primary threat actors and malware families operating in the Latin America and Caribbean (LAC) region based on the provided intelligence report for 2025.
# Threat Actor(s): LAC Financial Malware Clusters
## Attribution & Identity
The report identifies several distinct malware families and operation clusters acting within the LAC region. While specific individual names aren't provided, linguistic and behavioral analysis suggests local origins for some:
* **SORVEPOTEL Ops:** Likely Portuguese-speaking operators (based on panel artifacts) focused on Brazil.
* **Casbaneiro (Aliases: Mekotio, Metamorfo):** A well-established banking trojan cluster focused on the LAC financial sector.
* **LummaC2 & Vidar:** Infostealer operators (LummaC2 was dominant in H1 2025 until law enforcement intervention, succeeded by Vidar in H2).
* **Other key families:** BBTok, Coyote, and Herodotus.
## Activity Summary
In 2025, Insikt Group recorded **452 ransomware incidents** and a surge in banking trojan campaigns. Key operations include:
* **"Water Saci" Campaign:** A significant operation targeting Brazilian financial platforms using WhatsApp Web as a distribution vector.
* **Smishing/WhatsApp Worms:** Use of self-propagating messages on WhatsApp to distribute ZIP files containing malware (Coyote and BBTok).
* **Lynchpin Infrastructure:** SORVEPOTEL was observed being distributed by other families, specifically Coyote and Maverick, indicating a collaborative or "malware-as-a-service" ecosystem.
## Tactics, Techniques & Procedures
* **Initial Access:** Phishing (Email/Smishing), social engineering, and WhatsApp-based distribution.
* **Execution & Persistence:** ZIP/ISO files containing LNK files; use of PowerShell scripts for obfuscation.
* **Evasion:** DLL sideloading (embedding DLLs in downloaded files), use of legitimate Windows utilities to bypass security, and dynamic infrastructure hosting.
* **Mobile Specific:** Deployment of malicious APKs suplanting security apps (e.g., "Modulo Seguranca Stone").
* **Post-Exploitation:** Keylogging, screen capturing, and phishing overlays to steal credentials.
* **Messaging:** Heavy reliance on Telegram for C2 and communications.
## Targeting
* **Sectors:** Healthcare, Manufacturing, Government, IT, Education, and Financial Institutions.
* **Geography:** Primarily **Brazil, Mexico, and Argentina**. Secondary targets include Italy (Herodotus).
* **Victims:** Users of financial platforms and organizations utilizing outdated infrastructure or SaaS platforms without MFA.
## Tools & Infrastructure
* **Malware Families:** LummaC2, Vidar, SORVEPOTEL, Casbaneiro (Mekotio/Metamorfo), BBTok, Coyote, Herodotus, and Maverick.
* **Communication/C2 Platforms:**
* Telegram (End-to-end encrypted messaging)
* Dark Forums (Access-special forums)
* WhatsApp (Propagative distribution)
* **Infrastructure:** Dynamic hosting across various platforms.
* **Reported Domains/Artifacts:** Mentions of "Water Saci" campaign infrastructure. *(Note: Specific IPs and URLs were not provided in the snippet for defanging)*.
## Implications
The LAC region is experiencing a "maturity gap" where digital adoption (cloud/SaaS) has outpaced security implementation. The 2025 landscape shows high sophistication in evasion techniques combined with a reliance on traditional but effective vectors like WhatsApp. The transition from LummaC2 to Vidar demonstrates the resilience of the infostealer market despite law enforcement pressure.
## Mitigations
* **Authentication:** Urgent implementation of robust Multi-Factor Authentication (MFA) and access controls for all SaaS and cloud platforms.
* **Email/Message Security:** Implement security layers to detect malicious LNK, ISO, and ZIP files distributed via email and instant messaging.
* **User Training:** Awareness programs focusing on "smishing" and the risks of downloading files via WhatsApp Web or unofficial APKs.
* **System Hardening:** Decommissioning obsolete infrastructure and patching vulnerabilities in government and healthcare networks.
* **Endpoint Defense:** Utilizing EDR solutions to detect DLL sideloading and unusual PowerShell executions.