BlotchyQuasar: X-Force Hive0129 targeting financial intuitions in LATAM with a custom banking trojan

In late April through May 2023, IBM Security X-Force found several phishing emails leading to packed executable files delivering malware we have named BlotchyQuasar, likely developed by a group X-Force tracks as Hive0129. BlotchyQuasar is hardcoded to collect credentials from multiple Latin American-based banking applications and websites used within public and private environments. Similar operations conducted in late 2022 have also been noted delivering an earlier variant of this modified QuasarRAT by likely Spanish-speaking actors.

BlotchyQuasar, which X-Force describes as …

american applications april banking banking applications banking trojan collect credentials emails files financial hardcoded ibm ibm security latam malware may may 2023 phishing phishing emails security targeting trojan websites x-force