1 malware family

Water Curupira

Also known asWater CurupiraWater Curupira (campaign context)

Water Curupira is a tracked intrusion cluster associated with distribution of the Pikabot malware through targeted spearphishing campaigns. The activity is characterized by email thread spoofing to increase message credibility and by attachment-based delivery chains that rely on user interaction. Observed lures have included password-protected archive attachments containing heavily obfuscated JavaScript, as well as disk image files containing a shortcut masquerading as a document and a malicious DLL. In some cases, delivery has also involved a PDF attachment containing a malicious link to a Pikabot installer. The infection chain uses social engineering to obtain initial execution, then launches follow-on commands through the Windows command shell, downloads additional payload components with native utilities, and executes the final Pikabot DLL through rundll32. The installer chain includes substantial obfuscation and deobfuscation behavior intended to hinder analysis and evade detection. Based on the available evidence, Water Curupira is best understood as a malware distribution activity cluster focused on phishing-enabled initial access and payload delivery rather than a fully profiled nation-state or ransomware actor.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

1 of 15 tactics1 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0005

Stealth

1 technique

T1027

Obfuscated Files or Information

ARSENAL

Associated malware families

1 malware family attributed to this actor across reporting.

FamilyContextEvidenceLast seen

LatrodectusBumblebee and Latrodectus, which are both malware loaders, are designed to steal personal data, along with downloading and executing additional payloads onto compromised hosts.1Mar 18, 2026

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mitre attackNews

Jan 24, 2026

Water Curupira Pikabot Distribution, Campaign C0037 | MITRE ATT&CK®

Distribution activity cluster delivering Pikabot via spearphishing, using password-protected ZIPs with obfuscated JavaScript/IMG+LNK, downloading payloads with curl.exe, and executing via rundll32.exe.

mitre attackNews

Jan 24, 2026

User Execution: Malicious File, Sub-technique T1204.002 - Enterprise | MITRE ATT&CK®

Distributes Pikabot via password-protected ZIPs with obfuscated JavaScript and IMG containers with LNK+DLL execution chain.

mitre attackNews

Jan 25, 2026

Gather Victim Identity Information: Email Addresses, Sub-technique T1589.002 - Enterprise | MITRE ATT&CK®

Conducts spearphishing by spoofing existing email threads (thread hijacking/spoofing) as part of a distribution activity cluster.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping1

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal1

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.

Back to threat actors

1 malware family

Water Curupira

Also known asWater CurupiraWater Curupira (campaign context)

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

1 of 15 tactics1 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0005

Stealth

1 technique

T1027

Obfuscated Files or Information

ARSENAL

Associated malware families

1 malware family attributed to this actor across reporting.

FamilyContextEvidenceLast seen

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mitre attackNews

Jan 24, 2026

Water Curupira Pikabot Distribution, Campaign C0037 | MITRE ATT&CK®

mitre attackNews

Jan 24, 2026

User Execution: Malicious File, Sub-technique T1204.002 - Enterprise | MITRE ATT&CK®

Distributes Pikabot via password-protected ZIPs with obfuscated JavaScript and IMG containers with LNK+DLL execution chain.

mitre attackNews

Jan 25, 2026

Gather Victim Identity Information: Email Addresses, Sub-technique T1589.002 - Enterprise | MITRE ATT&CK®

Conducts spearphishing by spoofing existing email threads (thread hijacking/spoofing) as part of a distribution activity cluster.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping1

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal1

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.