Water Curupira Hackers Actively Distributing PikaBot Loader Malware

In 2023, the threat actor Water Curupira actively distributed the PikaBot loader malware via phishing campaigns. The malware provided unauthorized remote access and command execution via an established C&C server link. PikaBot is primarily designed to launch Cobalt Strike, a potential precursor for ransomware deployment. The campaigns utilize email trickery and only halt when detecting Russian or Ukrainian system languages.