Peeling back Banana RAT. [Research Saturday]

CyberWire Daily

N2K Networks, Inc.

Technology, News, Tech News, Daily News

4.8 • 1.1K Ratings

🗓️ 20 June 2026

⏱️ 29 minutes

🔗️ Recording | iTunes | RSS

🧾️ Download transcript

Summary

This week, we are joined by Tom Kellermann, Trend Micro's VP of AI Security and Threat Research, discussing their work on "Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud." Researchers from Trend Micro's MDR team uncovered the full operation behind Banana RAT, a sophisticated banking trojan they track as SHADOW-WATER-063, by analyzing both attacker infrastructure and infected victim systems. The malware uses fileless PowerShell execution, layered obfuscation, and remote-control capabilities to steal credentials, manipulate banking sessions, intercept Pix QR code payments, and facilitate financial fraud targeting Brazilian banks. The campaign appears to be operated by a Brazilian Portuguese-speaking cybercriminal group with ties to the broader Tetrade banking malware ecosystem and may be evolving toward a malware-as-a-service model. The research and executive brief can be found here: ⁠Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud Learn more about your ad choices. Visit megaphone.fm/adchoices

Transcript

Click on a timestamp to play from that location

0:00.0	You're listening to the Cyberwire Network, powered by N2K.
0:10.2	Looking to understand the cybersecurity risks emerging beyond Earth's atmosphere.
0:18.1	In the weekly Signals in Space newsletter, T-minus host Maria Vermazas and producer
0:23.0	Ethan Cook connect the dots between terrestrial infrastructure and the growing attack surface in space.
0:29.7	Each week, you'll get the latest space cyber headlines, direct access to the week's T-minus
0:34.6	podcast conversation, plus expert insights and resources
0:38.4	to help security professionals
0:39.9	better understand this rapidly evolving domain.
0:44.0	Space systems are becoming critical infrastructure.
0:46.8	Signals in space helps you stay ahead of the threats
0:49.5	shaping the next frontier.
0:51.8	Subscribe now to the Signals and Space newsletter.
1:03.2	The internet is coaching our kids.
1:07.9	When boys hear that on repeat, it shapes how they see themselves. We can't
1:12.1	leave it to those voices. We have to be louder. Together with EEE, we need to coach them, guide
1:17.6	them, back them. Building our boys up every chance we get. Be yourself. Back your mates.
1:22.7	Confidence comes from a win.
1:24.1	As proud partner of the England's teams, EEEE has support and guidance to help build all our
1:29.4	boys up on and off the pitch.
1:31.3	Search E.E. Yes, boys.
1:39.5	Hello everyone and welcome to the CyberWires Research Saturday.
1:43.7	I'm Dave Bittner, and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems and protecting ourselves in our rapidly evolving cyberspace. Thanks for joining us.
	...

Transcript will be available on the free plan in 16 days. Upgrade to see the full transcript now.

Previous episode | Next episode

Disclaimer: The podcast and artwork embedded on this page are from N2K Networks, Inc., and are the property of its owner and not affiliated with or endorsed by Tapesearch.

Generated transcripts are the property of N2K Networks, Inc. and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.