GINC-APT-0863 · Targeted, sponsor unknown

Operation Bandidos

Category
Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
Origin
Unknown
Motivation
Information theft and espionage
Seen
2021
Sources
3 sources carry it
Identifier
GINC-APT-0863 · operation-bandidos

What it is

(ESET) In 2021 we detected an ongoing campaign targeting corporate networks in Spanish-speaking countries, with 90% of the detections in Venezuela. When comparing the malware used in this campaign with what was previously documented, we found new functionality and changes to this malware, known as Bandook. We also found that this campaign targeting Venezuela, despite being active since at least 2015, has somehow remained undocumented. Given the malware used and the targeted locale, we chose to name this campaign Bandidos.

Targets

Countries
Venezuela

Tools

The tools and malware families the sources tie to it.

  • Bandook

Sources