{
  "name": "Unpacking Augmented Marauder\u2019s Multi-Pronged Casbaneiro Campaigns",
  "slug": "unpacking-augmented-marauders-multi-pronged-casbaneiro-campaigns",
  "description": "BlueVoyant researchers have uncovered a broad, multi-pronged phishing campaign targeting Spanish-speaking users in organizations across Latin America and now Europe as well. While recent industry intelligence heavily documented attacks utilizing WhatsApp to deliver banking trojans under the umbrella of the Brazil-based eCrime group Augmented Marauder (a.k.a. Water Saci)",
  "published": "2026-04-01T13:27:02.540000+00:00",
  "created_at": "2026-04-01T15:26:25.599000+00:00",
  "modified_at": "2026-04-01T13:26:25+00:00",
  "created_at_opencti": "2026-04-01T15:26:25.599000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "augmented marauder",
    "banking trojan",
    "casbainero",
    "phishing"
  ],
  "tags": [
    "2026-04-01",
    "augmented marauder",
    "banking trojan",
    "casbainero",
    "phishing"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "509ecc9c-0a3b-421e-b2a4-488c1fca73f9",
        "name": "3e4002c7f0909d3c743b3586098e248d413f485c6bb033cafdb322bd8b206ebb"
      },
      {
        "id": "5327e6a9-6aa9-4c76-bc4e-2a58251a0971",
        "name": "b56d00addd6c6a266de3c739dad22aa1de52624066544929754d47332257cba6"
      },
      {
        "id": "26304482-da25-47cb-9261-c7bd0598096c",
        "name": "https://tt.grupobedfs.com/.../gera_pdf.php"
      },
      {
        "id": "cfea8f72-5738-44b1-b689-57a77dd50dac",
        "name": "69fc15919044fc6a94bb251afd90a0a07204b79df3bc62c49ba6b0febefbc33e"
      },
      {
        "id": "c72a1820-99ae-4b1a-8941-f384412316b7",
        "name": "grupobedfs.com"
      },
      {
        "id": "9cce00b9-dec3-4558-a9b6-2cd36b42de8a",
        "name": "239cb9232fe01c8b82eb627f66acc6848cb223dfea46d4923844c1fe20f1de49"
      },
      {
        "id": "bc2ab150-b655-4008-91e6-f75f5b130a17",
        "name": "1af69a3283e28a8cc9a11819ecc2f2cff46dcabbfa78cefc71a02b881a064593"
      },
      {
        "id": "81c926d5-353f-4aa4-a486-d76a9e4bffa6",
        "name": "https://cgf.facturastbs.shop/a/08/150822/au"
      },
      {
        "id": "0b221fa8-ceea-43b5-a733-5eac7e60aba1",
        "name": "4e08a1525a62a387595a2e4942b56ec3f3b3259996115ea2e6ea3638ccb87705"
      },
      {
        "id": "0d13e99d-90a5-415a-8385-f811cd9b8249",
        "name": "facturastbs.shop"
      },
      {
        "id": "3d4ce263-43ce-4b03-8300-692f30e65598",
        "name": "d1d08f7e44641d921fad22ed175b928c696befd14a55271eb203f8fcaff553d5"
      },
      {
        "id": "af6c753f-8ff6-48db-8301-8833fa910096",
        "name": "tt.grupobedfs.com"
      },
      {
        "id": "28065b91-79f7-4bb6-82ee-0722ecb862a9",
        "name": "1693448804bf1c90ad7317af250bcd6ea021256e33e983b224aea81d4ecc2e20"
      },
      {
        "id": "0a3ce569-b785-41b6-b2d9-cb555ce3af1e",
        "name": "cgf.facturastbs.shop"
      }
    ],
    "intrusion_sets": [
      {
        "id": "dd1525ea-1a5f-443b-991e-c2f7c0a944f8",
        "name": "Augmented Marauder",
        "slug": "augmented-marauder"
      }
    ],
    "malware": [
      {
        "id": "fd90682a-2083-4dce-9321-727313b86232",
        "name": "Casbaneiro",
        "slug": "casbaneiro"
      }
    ],
    "observables": [
      {
        "id": "c6928c1f-d9bb-4fc2-87a1-26a5d225a748",
        "name": "facturastbs.shop"
      },
      {
        "id": "b7e1b224-e028-468a-b9a5-0188eb862412",
        "name": "grupobedfs.com"
      },
      {
        "id": "d1480efc-8b65-4826-a05f-bf47ed0e6fb9",
        "name": "tt.grupobedfs.com"
      },
      {
        "id": "089847fe-f211-46d7-8841-c700d938b34f",
        "name": "cgf.facturastbs.shop"
      },
      {
        "id": "a04e3ad4-2145-459d-8451-02dfc96c2f60",
        "name": "https://cgf.facturastbs.shop/a/08/150822/au"
      },
      {
        "id": "98cc66d1-bd25-4d01-b82c-60459a5c15e1",
        "name": "https://tt.grupobedfs.com/.../gera_pdf.php"
      },
      {
        "id": "",
        "name": "3e4002c7f0909d3c743b3586098e248d413f485c6bb033cafdb322bd8b206ebb"
      },
      {
        "id": "",
        "name": "b56d00addd6c6a266de3c739dad22aa1de52624066544929754d47332257cba6"
      },
      {
        "id": "",
        "name": "69fc15919044fc6a94bb251afd90a0a07204b79df3bc62c49ba6b0febefbc33e"
      },
      {
        "id": "",
        "name": "239cb9232fe01c8b82eb627f66acc6848cb223dfea46d4923844c1fe20f1de49"
      },
      {
        "id": "",
        "name": "1af69a3283e28a8cc9a11819ecc2f2cff46dcabbfa78cefc71a02b881a064593"
      },
      {
        "id": "",
        "name": "4e08a1525a62a387595a2e4942b56ec3f3b3259996115ea2e6ea3638ccb87705"
      },
      {
        "id": "",
        "name": "d1d08f7e44641d921fad22ed175b928c696befd14a55271eb203f8fcaff553d5"
      },
      {
        "id": "",
        "name": "1693448804bf1c90ad7317af250bcd6ea021256e33e983b224aea81d4ecc2e20"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Spain"
      },
      {
        "id": "",
        "name": "grupobedfs.com"
      },
      {
        "id": "",
        "name": "facturastbs.shop"
      },
      {
        "id": "",
        "name": "tt.grupobedfs.com"
      },
      {
        "id": "",
        "name": "cgf.facturastbs.shop"
      }
    ]
  },
  "external_refs": [
    {
      "id": "45a151af-c20c-47cc-a0f7-5282d775b133",
      "standard_id": "external-reference--6637b95c-9c6e-5811-88f5-7b646ed93bb4",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.bluevoyant.com/blog/augmented-marauders-multi-pronged-casbaneiro-campaigns",
      "hash": null,
      "external_id": null,
      "created": "2026-04-01T15:26:25.551Z",
      "modified": "2026-04-01T15:26:25.551Z",
      "createdById": null
    },
    {
      "id": "27396a0e-ced2-43a9-9fe7-5b3b79574c40",
      "standard_id": "external-reference--a6d920f3-2735-52e6-85d6-a4ad1d633f1e",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/69cd1d262a834decd25abb14",
      "hash": null,
      "external_id": "69cd1d262a834decd25abb14",
      "created": "2026-04-01T15:26:25.529Z",
      "modified": "2026-04-01T15:26:25.529Z",
      "createdById": null
    }
  ]
}