Threat intelligence / Campaign

Water Curupira Pikabot Distribution

[Pikabot](https://attack.mitre.org/software/S1145) was distributed in [Water Curupira Pikabot Distribution](https://attack.mitre.org/campaigns/C0037) throughout 2023 by an entity linked to BlackBasta ransomware deployment via email attachments. This activity followed the take-down of [QakBot](https://attack.mitre.org/software/S0650), with several technical overlaps and similarities with [QakBot](https://attack.mitre.org/software/S0650), indicating a possible connection. The identified activity led to the deployment of tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154), while coinciding with campaigns delivering [DarkGate](https://attack.mitre.org/software/S1111) and [IcedID](https://attack.mitre.org/software/S0483) en route to ransomware deployment.(Citation: TrendMicro Pikabot 2024)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Pikabot](https://attack.mitre.org/software/S1145) was distributed in [Water Curupira Pikabot Distribution](https://attack.mitre.org/campaigns/C0037) throughout 2023 by an entity linked to BlackBasta ransomware deployment via email attachments. This activity followed the take-down of [QakBot](https://attack.mitre.org/software/S0650), with several technical overlaps and similarities with [QakBot](https://attack.mitre.org/software/S0650), indicating a possible connection. The identified activity led to the deployment of tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154), while coinciding with campaigns delivering [DarkGate](https://attack.mitre.org/software/S1111) and [IcedID](https://attack.mitre.org/software/S0483) en route to ransomware deployment.(Citation: TrendMicro Pikabot 2024)

13 recorded

Relationships

uses

Malware

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Email Addresses

Technique

uses

Malware

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

Malware

uses

Technique

uses

to Spearphishing Attachment

Technique

uses

to User Execution

Technique

uses

to Windows Command Shell

Technique

2 external

References

mitre-attack

C0037

TrendMicro Pikabot 2024

https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html