SORVEPOTEL

Reported Context (3)

#TCLBANKER TCLBANKER Targets 59 Financial Platforms and Spreads via WhatsApp and Outlook
It also includes self-spreading worm modules for WhatsApp and Outlook, and Elastic Security Labs says it may represent a major evolution of the Maverick/Sorvepotel family. TCLBanker Banking Trojan Spreads Through WhatsApp and Outlook
The campaign uses DLL side-loading, nine evasion techniques, Google Cloud Storage-hosted configs, ItaÃº-specific shortcut hijacking, and has links to WhatsApp-distributed SORVEPOTEL lure chains. Rust-Based VENON Banking Trojan Targets 33 Brazilian Financial and Digital-Asset Platforms

Malware (8)

People (4)

Threat Actors (1)

MITRE ATT&CK (20)

Vendors (1)

Products (14)

Tools (8)

Industries (4)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.