Loading threat actor…
TA2725 is a financially motivated cybercriminal threat actor tracked since March 2022 that primarily targets organizations and users in Brazil, Mexico, and Spain. It distributes Brazilian banking malware, including Mispadu, Astaroth, and historically Grandoreiro, and conducts credential-phishing campaigns. Its theft objectives include online banking credentials, consumer account credentials, and payment information associated with services such as Netflix and Amazon. Its country of origin is not established. TA2725 commonly uses phishing emails containing links that pass through redirectors hosted on GoDaddy infrastructure before delivering compressed malware packages from legitimate cloud services, including Amazon Web Services, Google Cloud, and Microsoft Azure. Lures have included utility bills and impersonation of legitimate businesses. Grandoreiro delivery chains use loaders that inject malicious code into legitimate applications and retrieve the final payload. The malware supports keylogging, screen capture, and fraudulent banking overlays for credential theft. In late August 2023, TA2725 conducted simultaneous campaigns against Mexico and Spain using shared infrastructure and a Grandoreiro build containing overlays for banks in both countries. In January 2025, TA2725 expanded its delivery repertoire to include ScreenConnect, using energy-bill lures and compressed executables against organizations in Mexico. It has also used personalized phishing imagery depicting purported physical mail addressed to recipients.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Briefly cited as an example of a banking Trojan actor whose use of AI reportedly increases attack noise while reducing sophistication. The reference provides no campaign-level details.
Referenced as another actor observed using a rare social-engineering lure technique (customized photo of purported physical mail showing recipient name/address). No additional operational details provided in this content.
Cybercriminal threat actor known for Brazilian banking malware and credential phishing; expanded to delivering ScreenConnect as a first-stage payload in campaigns targeting Mexico.
Uses Brazilian banking malware and phishing to target organizations and users, primarily in Brazil and Mexico, and more recently Spain. The group delivers Grandoreiro to steal banking credentials, consumer credentials, and payment information, including for Netflix and Amazon accounts.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.