SHADOW-WATER-063 Banana RAT Banking Fraud Campaign

SHADOW-WATER-063 is a financially motivated threat actor cluster, likely based in Brazil, operating 'Projeto Banana' (Banana RAT). This campaign exclusively targets customers of 16 Brazilian financial institutions and cryptocurrency exchanges. The operation is highly sophisticated, utilizing a FastAPI-based server-side polymorphism engine that generates unique, obfuscated PowerShell payloads for every victim to evade signature-based detection.

The attack chain typically begins with a phishing lure (e.g., fake electronic invoices) leading to the execution of a malicious batch file. This initiates a multi-stage, fileless PowerShell infection that resides in memory. Once established, the malware provides operators with full remote control, including the ability to inject fake banking overlays, intercept Pix QR code transactions, and log keystrokes.

This threat represents a significant risk to the Brazilian financial sector due to its tailored tradecraft, including a dedicated Pix interception subsystem. While it shares behavioral similarities with the 'Tetrade' family (Grandoreiro, Mekotio), its Python-based backend and advanced polymorphism distinguish it as a distinct, well-resourced evolution in regional banking malware.