Skip to page content

AEGLIX MIND

Intelligence for Africa and the Gulf

Reviewed campaign intelligence

Water Curupira Pikabot Distribution

Historical · OTHER · Global

Last reviewed:

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Pikabot was distributed in Water Curupira Pikabot Distribution throughout 2023 by an entity linked to BlackBasta ransomware deployment via email attachments. This activity followed the take-down of QakBot, with several technical overlaps and similarities with QakBot, indicating a possible connection. The identified activity led to the deployment of tools such as Cobalt Strike, while coinciding with campaigns delivering DarkGate and IcedID en route to ransomware deployment.(Citation: TrendMicro Pikabot 2024)

This is a historical record and does not establish current campaign activity.

Threat actor
Not established
Attribution confidence
Not established
First documented activity
2023-01-01
End date
Not established
Estimated victims
Not established
Reported impact
Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

  1. Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

    Source: MITRE ATT&CK

  2. Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

    Source: MITRE ATT&CK

MITRE ATT&CK techniques

  • T1204.002 · Malicious File

    Execution — Water Curupira Pikabot Distribution delivered Pikabot installers as password-protected ZIP files containing heavily obfuscated JavaScript, or IMG files containing an LNK mimicking a Word document and a malicious DLL.(Citation: TrendMicro Pikabot 2024)

  • T1059.003 · Windows Command Shell

    Execution — Water Curupira Pikabot Distribution installation via JavaScript will launch follow-on commands via cmd.exe.(Citation: TrendMicro Pikabot 2024)

  • T1204 · User Execution

    Execution — Water Curupira Pikabot Distribution requires users to interact with malicious attachments in order to start Pikabot installation.(Citation: TrendMicro Pikabot 2024)

  • T1105 · Ingress Tool Transfer

    Command And Control — Water Curupira Pikabot Distribution used Curl.exe to download the Pikabot payload from an external server, saving the file to the victim machine's temporary directory.(Citation: TrendMicro Pikabot 2024)

  • T1204.001 · Malicious Link

    Execution — Water Curupira Pikabot Distribution distributed a PDF attachment containing a malicious link to a Pikabot installer.(Citation: TrendMicro Pikabot 2024)

  • T1589.002 · Email Addresses

    Reconnaissance — Water Curupira Pikabot Distribution utilizes thread spoofing of existing email threads in order to execute spear phishing operations.(Citation: TrendMicro Pikabot 2024)

  • T1566.001 · Spearphishing Attachment

    Initial Access — Water Curupira Pikabot Distribution attached password-protected ZIP archives to deliver Pikabot installers.(Citation: TrendMicro Pikabot 2024)

  • T1059.007 · JavaScript

    Execution — Water Curupira Pikabot Distribution initial delivery included obfuscated JavaScript objects stored in password-protected ZIP archives.(Citation: TrendMicro Pikabot 2024)

  • T1140 · Deobfuscate/Decode Files or Information

    Stealth — Water Curupira Pikabot Distribution used highly obfuscated JavaScript files as one initial installer for Pikabot.(Citation: TrendMicro Pikabot 2024)

  • T1218.011 · Rundll32

    Stealth — Water Curupira Pikabot Distribution utilizes rundll32.exe to execute the final Pikabot payload, using the named exports `Crash` or `Limit` depending on the variant.(Citation: TrendMicro Pikabot 2024)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

  • MITRE ATT&CK C0037

    Official MITRE ATT&CK campaign record C0037. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.