MalwarePublished 1 Apr 2026

Unpacking Augmented Marauder’s Multi-Pronged Casbaneiro Campaigns

Source AlienVault OTX General

Description

BlueVoyant researchers have uncovered a broad, multi-pronged phishing campaign targeting Spanish-speaking users in organizations across Latin America and now Europe as well. While recent industry intelligence heavily documented attacks utilizing WhatsApp to deliver banking trojans under the umbrella of the Brazil-based eCrime group Augmented Marauder (a.k.a. Water Saci)

Impact

This campaign poses a significant risk to organizations with Spanish-speaking employees, especially financial institutions and enterprises in Latin America and Europe. Successful infections can lead to credential theft, unauthorized access to banking accounts, and financial fraud, resulting in direct monetary losses. Beyond financial damage, compromised systems may be used for further lateral movement or data exfiltration, impacting confidentiality and integrity. The use of WhatsApp and other messaging platforms as delivery vectors increases the likelihood of user interaction and infection. Organizations lacking robust phishing defenses or user awareness training are particularly vulnerable. The campaign's expansion into Europe indicates a growing geographic scope, potentially affecting multinational companies and financial services providers. While the campaign is rated medium severity, the financial and reputational damage from successful intrusions can be substantial. The lack of known exploits in the wild suggests the threat is still emerging, offering a window for proactive defense.

Defensive guidance

1. Implement targeted phishing awareness training focused on recognizing social engineering tactics used in this campaign, including suspicious WhatsApp messages and email links. 2. Deploy advanced email and messaging security solutions capable of detecting and blocking phishing URLs and malicious attachments, including sandboxing suspicious files. 3. Block known malicious domains and URLs associated with the campaign (e.g., facturastbs.shop, grupobedfs.com) at network perimeter and DNS levels. 4. Monitor network traffic for connections to identified malicious IPs and domains and investigate any anomalies. 5. Enforce multi-factor authentication (MFA) on all financial and critical systems to reduce impact if credentials are compromised. 6. Regularly update endpoint protection platforms with the latest threat intelligence and malware signatures. 7. Conduct incident response exercises simulating phishing attacks to improve detection and containment capabilities. 8. Encourage users to verify unexpected financial or invoice-related communications through independent channels before taking action. 9. Collaborate with regional cybersecurity organizations to share intelligence and stay updated on evolving tactics used by Augmented Marauder. 10. Review and harden WhatsApp and other messaging platform usage policies to limit exposure to unsolicited messages from unknown contacts.

Indicators of compromise

Domains 4

facturastbs.shop
grupobedfs.com
cgf.facturastbs.shop
tt.grupobedfs.com

URLs 2

https://cgf.facturastbs.shop/a/08/150822/au
https://tt.grupobedfs.com/.../gera_pdf.php

Hashes 10

aec9ed01b85713acc6a7f1da4d94ee1b
a5eacd9028639a7b148b66de168037c3cea78ecf
1693448804bf1c90ad7317af250bcd6ea021256e33e983b224aea81d4ecc2e20
1af69a3283e28a8cc9a11819ecc2f2cff46dcabbfa78cefc71a02b881a064593
239cb9232fe01c8b82eb627f66acc6848cb223dfea46d4923844c1fe20f1de49
3e4002c7f0909d3c743b3586098e248d413f485c6bb033cafdb322bd8b206ebb
4e08a1525a62a387595a2e4942b56ec3f3b3259996115ea2e6ea3638ccb87705
69fc15919044fc6a94bb251afd90a0a07204b79df3bc62c49ba6b0febefbc33e
b56d00addd6c6a266de3c739dad22aa1de52624066544929754d47332257cba6
d1d08f7e44641d921fad22ed175b928c696befd14a55271eb203f8fcaff553d5

Community reviews

Loading reviews…