Campaign DetailSource-backed corpus

Water Curupira Pikabot Distribution

Pikabot was distributed in Water Curupira Pikabot Distribution throughout 2023 by an entity linked to BlackBasta ransomware deployment via email attachments. This activity followed the take-down of QakBot, with several technical overlaps and similarities with QakBot, indicating a possible connection. The identified activity led to the deployment of tools such as Cobalt Strike, while coinciding with campaigns delivering DarkGate and IcedID en route to ransomware deployment.

Last updated May 24, 2026, 8:00 PM EDT

Actor Mapping

Mapped Threat Actors

Attribution not specified in seed source

Targeting

Target Sectors / Countries

Cross-industry

Tradecraft

ATT&CK / Techniques

T1204.002T1059.003T1204T1105T1204.001T1589.002T1566.001T1059.007T1140T1218.011

Tools / Observables

Malware, Tools, CVEs

T1105 Ingress Tool Transfer

Source Reconciliation

How IntelliOS Is Treating This Campaign

Campaign rows are retained as source-backed context. Actor mappings do not automatically merge actor records; SOCRadar, MITRE, Mandiant, CrowdStrike, Microsoft, and other future sources can disagree on boundaries, aliases, or campaign ownership.

Campaign row is compressed for directory seeding. Confirm actor linkage, infrastructure, and targeting with source-specific reports and local telemetry.

IntelliOS

Related Intel Products

None Found

Citations

Source Trust / Citations

[1] Water Curupira Pikabot Distribution - MITRE ATT&CKMITRE ATT&CK
[2] Shinji Robert Arasawa, Joshua Aquino, Charles Steven Derion, Juhn Emmanuel Atanque,...TrendMicro Pikabot 2024