Loading story…
A long-running cyberespionage operation dubbed Bandidos used the Bandook remote access trojan to infiltrate corporate networks across Spanish-speaking Latin America, with roughly 90% of observed detections concentrated in Venezuela. The campaign, active since at least 2015, relied on phishing emails carrying PDF lures that directed victims to password-protected archives containing a Delphi dropper. That dropper injected Bandook into iexplore.exe through process hollowing, established persistence via Windows Registry changes, and connected to command-and-control servers over TCP.
Researchers said the malware supported extensive surveillance and theft functions, including screenshot capture, webcam and microphone recording, USB data theft, and interception of Chrome credentials, while also downloading additional DLLs to expand capability. The 2021 variant showed notable evolution from earlier Bandook activity, including a shift from CAST-256 to GOST in the dropper, a reduced DLL set, and support for 132 commands. The infrastructure and tooling overlapped with previously documented Bandook-linked operations, including Operation Manul, Dark Caracal, and Check Point research, reinforcing the assessment that the operators were conducting sustained espionage against Venezuelan organizations in sectors such as manufacturing, construction, healthcare, software services, and retail.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
In 2021, ESET detected an ongoing Bandidos campaign and analyzed a newer variant whose Delphi dropper switched from CAST-256 to GOST encryption and reduced its auxiliary DLL set to two modules. The malware retained extensive espionage capabilities, including credential theft, screenshot capture, webcam and audio recording, and USB data theft.
ESET reported that samples labeled as "Full Version" in Check Point's 2020 Bandook report targeted Venezuela and belonged to the Bandidos campaign. This linked previously documented Bandook activity to the broader Bandidos espionage operation.
ESET assessed that the Bandidos cyberespionage campaign had been active since at least 2015, using the Bandook remote access trojan against corporate networks in Spanish-speaking countries. The campaign was primarily focused on Venezuela, which accounted for about 90% of detections.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 69 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Arctic Wolf Labs attributed a targeted June 2026 intrusion at a Venezuelan communications-sector organization, with medium confidence, to the Lebanese-linked espionage group **Dark Caracal**. The campaign deployed a new modular Go-based framework, **GoCaracal**, alongside an updated variant of the Bandook remote-access trojan (RAT). GoCaracal’s extended profile supports persistence, intelligence collection, keylogging, browser-cookie theft, WebRTC desktop access, SOCKS5 proxying, and Windows Registry manipulation. The intrusion began with Spanish-language financial or tax-themed phishing messages carrying malicious SVG attachments. Victims were redirected through URL shorteners to document-themed download domains and 7-Zip archives, which ultimately delivered GoCaracal and a Delphi loader containing Bandook. GoCaracal includes an Ethereum-based command-and-control fallback; Arctic Wolf tracked its development from January through July 2026 and found that 23 of 24 observed GoCaracal C2 addresses were hosted on AEZA Group networks, while Bandook infrastructure was hosted at AlexHost.
Sep 16, 2026
The **Machete** cyberespionage group continued targeting government and military organizations in Latin America, with recent activity focused on Venezuelan government entities and the Ecuadorean military. Researchers observed more than 50 compromised systems communicating with Machete command-and-control infrastructure over a two-month period, while operators exfiltrated gigabytes of confidential data each week. The campaign relied on highly tailored spearphishing emails that used stolen legitimate documents as decoys and reflected detailed knowledge of military communications and target-specific terminology. The malware toolset, active for years under the names **Machete** and **El Machete**, evolved into a more capable Python-based platform with added obfuscation, persistence, geolocation, browser data theft, removable-media collection, and data exfiltration over FTP with HTTP fallback. Reporting across multiple investigations indicates the group has maintained a long-running focus on Latin American targets, and researchers assessed the operators are likely Spanish-speaking and may have a physical presence in one of the affected countries, partly because the malware supports copying stolen data to removable drives.
Aug 14, 2026
Kaspersky reported that the threat actor **Bloody Wolf**—tracked by the vendor as **Stan Ghouls**—is running a spear-phishing campaign primarily targeting organizations in **Uzbekistan** and **Russia**, with additional, lower-volume activity observed in other countries. The activity, ongoing since at least 2023, has targeted sectors including manufacturing, finance, and IT, and has also been observed hitting government, logistics, healthcare, and education entities. Reported victim counts for the current wave are on the order of **50+ in Uzbekistan** and **~10 in Russia**, with the actor assessed as likely financially motivated, though the heavy use of remote-access tooling may also support espionage objectives. The intrusion chain relies on phishing emails carrying **malicious PDF lures** (e.g., court/government-themed documents) that embed links leading to a downloader/loader, after which the actor deploys **NetSupport RAT** (a legitimate remote administration tool) for remote control—representing a shift from prior use of **STRRAT**. Kaspersky noted the loader’s behavior includes user-deception (fake error messages) and basic execution controls (e.g., limiting repeated installation attempts), while another reported lure uses a social-engineering pretext that victims must install a **Java Runtime Environment update**, ultimately delivering a **malicious JAR**—a technique Kaspersky described as a distinctive fingerprint for this actor. Prior related reporting cited phishing activity in Kyrgyzstan distributing similar tooling, indicating a broader regional focus beyond the current Uzbekistan/Russia emphasis.
Jun 29, 2026