Threats

By Gerardo Corona & Julio Vidal Ocelot Team Context Ransomware gangs have found a profitable market in LATAM, but they are not alone, they need region-based actors to provide them the initial access to the companies. These local groups create phishing campaigns based on the government activities during the year, like Tax season, testament month, …

Botnet Fenix: New botnet going after tax payers in Mexico and Chile Read More »

Fernando Garcia & Dan Regalado Ocelot team Context The Metabase Q Security Operations Center (SOC) triages millions of alerts a day but a recent attempt to infect a customer’s network caught our attention. Although the customers’ endpoint detection and response security tools properly blocked the initial payload, the use of fake certificates to try to …

Inside Mispadu massive infection campaign in LATAM Read More »

By Salvador Mendoza from Metabase Q’s R&D Team Metabase Q’s offensive security team, Ocelot, discovered a potential abuse of an inadequate issuer business practice to reset the PIN RETRY Counter (PRC) on Europay, MasterCard, Visa (EMV) chip contact cards. It would lead to a new attack called Pin Automatic Try Attack (PINATA). PINATA could brute …

PINATA: The new cyberthreat affecting the financial sector Read More »

By  Jesus Dominguez from Metabase Q’s Ocelot Team Context Janeleiro is amalware that has been attacking corporate users of large banks in Brazil since2019. This malware displays fake pop-up windows that pretend to be legitimateBrazilian bank forms, enabling it to gain unauthorized access to the victims’online banking accounts. Since January26, 2021, the Ocelot team has …

Janeleiro.mx Threat Briefing Read More »

By  Miguel Gonzalez from Metabase Q’s Ocelot Team Ransomware-as-a-Service is on the rise worldwide, and Mexico has become a target. Just a few days after the group Avaddon announced the compromise of Loteria Nacional, Ocelot detected a second variant of the malware targeting another company in the same country. In this blog, we present the …

Neshta and Avaddon groups teaming up to infect Mexican company Read More »

By Miguel Gonzalez & Jesus Dominguez from Metabase Q’s Ocelot Team Executive Summary On May 7th, 2021, Colonial Pipeline reported that its digital infrastructure had been compromised due to a cyberattack, and as a precautionary measure, it would suspend its services until the severity of the situation was determined. Colonial is the largest pipeline operator …

Inside DarkSide, the ransomware that attacked Colonial Pipeline Read More »