RegistroCiberVE
Claims and excluded records

Excluded / contextual

Outside the main registry and its statistics

Multi-incident summary

Report on the Bandidos/Bandook campaign and multiple victims. Samples and statistics describe an operation, not one event to add to the main count.

spyware remote access trojan Public report: Date confidence: Low

Campaña de espionaje Bandidos con Bandook

La campaña de espionaje «Bandidos», activa desde al menos 2015, utilizaba variantes del RAT Bandook contra redes corporativas de países hispanohablantes, según una investigación publicada el 7 de julio de 2021. ESET informó que el 90 % de sus detecciones de la campaña se concentró en Venezuela y que registró allí más de 200 detecciones de droppers durante 2021. Su telemetría mostró intereses en manufactura, construcción, salud, servicios de software y comercio minorista, pero no identificó una organización ni un número de víctimas únicas. La cadena analizada usaba correos con PDF, enlaces y archivos comprimidos; las muestras podían persistir, comunicarse con C2, transmitir información del sistema y exfiltrar credenciales mediante una extensión maliciosa. Esos comportamientos técnicos y capacidades no demuestran por sí solos exfiltración o impacto en una víctima venezolana concreta. Proofpoint observó independientemente actividad Bandook relacionada en 2021, pero no valida las cifras de ESET ni permite atribuir toda la campaña histórica a TA2721.

Overview

Missing evidence

organizaciones venezolanas nominales y número de víctimas únicasmetodología y denominador completos de la telemetría de deteccionesconfirmación víctima-por-víctima de ejecución e infeccióndatos efectivamente exfiltrados de una víctima venezolanaimpacto operativo, financiero o de disponibilidadidentidad o atribución técnica del operador

Impact details

ESET analizó muestras capaces de transmitir información básica del sistema y de exfiltrar credenciales introducidas en formularios mediante una extensión maliciosa. También registró más de 200 detecciones de droppers en Venezuela durante 2021. No publicó una víctima nominal, un recuento de organizaciones únicas ni prueba víctima-por-víctima de ejecución, exfiltración, filtración, interrupción o pérdida financiera.

redes corporativas y equipos Windows observados en telemetría de ESET; organizaciones no identificadas

Classification & severity

Category
Malicious code
Subtype
spyware remote access trojan
Confidence
High

ESET analizó muestras Bandook de la campaña «Bandidos», su persistencia, comunicación C2, comandos de vigilancia y extensión maliciosa de Chrome; publicó indicadores reproducibles.

Severity assessment

Medium
Information impact
Suspected
Affected scope
Cross-sector

La campaña y el comportamiento técnico de Bandook están sólidamente documentados y la telemetría abarca varios sectores venezolanos, pero no hay víctimas nominales, recuento de organizaciones, impacto operativo ni exposición de datos confirmada para una víctima concreta.

Data exfiltration· Claimed

Timeline

Discovery

La revisión retrospectiva de ESET vinculó muestras con identificadores de campaña de enero y junio de 2015 y situó la actividad de «Bandidos» desde al menos ese año.

Discovery

ESET registró más de 200 detecciones de droppers en Venezuela durante 2021. La cifra corresponde a detecciones de telemetría, no a víctimas únicas ni a compromisos exitosos confirmados.

Disclosure

ESET publicó su investigación técnica de la campaña «Bandidos», con el 90 % de sus detecciones concentrado en Venezuela, y detalló la cadena de entrega y el comportamiento de Bandook.

Evidence & sources

5 sources

Bandidos at large: A spying campaign in Latin America

ESET Research / WeLiveSecurity Jul 7, 2021
Primary Security research Source confidence: High

What this source supports

  • ESET documented an active Bandidos campaign using Bandook against corporate networks in Spanish-speaking countries, active since at least 2015
  • ESET reported 90% of its campaign detections in Venezuela and more than 200 malware-dropper detections there during 2021
  • ESET telemetry indicated interests spanning manufacturing, construction, healthcare, software services and retail but did not identify a specific vertical or any named organization
  • ESET analyzed the PDF-link-compressed-archive delivery chain and Bandook execution, persistence, command-and-control and exfiltration behavior
  • the report documents malware capabilities and sample behavior but does not publish a unique victim count or victim-specific impact

Evidence limits

ESET telemetry and reverse engineering are strong campaign evidence. A detection is not necessarily a successful compromise or a unique victim; no Venezuelan organization, affected-person count, victim-specific data loss or outage is identified.

Relevance to this case

Primary technical source for the campaign name, Venezuelan concentration, chronology, delivery chain, analyzed behavior and limitations.

ESET Research discovers Bandidos, a new spying campaign in Venezuela

ESET Newsroom Jul 7, 2021
Context Official statement Source confidence: High

What this source supports

  • ESET officially announced its Bandidos research and repeated that 90% of ESET telemetry detections were in Venezuela
  • ESET reported more than 200 dropper detections in Venezuela in 2021 and said that it could not identify a specific vertical
  • the newsroom summary describes the PDF-link-archive delivery chain and credential-retrieval functionality
  • this is the same publisher and underlying investigation as the WeLiveSecurity report, not independent corroboration

Evidence limits

Authoritative for ESET's own announcement, but dependent on the same ESET investigation and not evidence of a named victim or victim-specific impact.

Relevance to this case

Useful official summary and dateline; retained as same-publisher context rather than an independent source.

Experts Uncover Malware Attacks Targeting Corporate Networks in Latin America

The Hacker News / Ravie Lakshmanan Jul 8, 2021
Context Media report Source confidence: Medium

What this source supports

  • Secondary reporting accurately summarizes ESET's Bandidos/Bandook disclosure, Venezuelan focus and PDF-to-archive delivery chain
  • the article repeats malware capabilities and ESET researcher statements
  • it contributes no independent telemetry, named victim, forensic artifact or victim-impact confirmation

Evidence limits

Independent publisher but wholly derivative of ESET for this campaign. The remaining large images on the current page are advertising or unrelated current-content cards, not incident evidence.

Relevance to this case

Retained for contemporaneous secondary context and the corrected 8 July publication date, not as independent technical corroboration.

New Threat Actor Uses Spanish Language Lures to Distribute Seldom Observed Bandook Malware

Proofpoint Threat Research Jul 19, 2021
Corroborating Security research Source confidence: Medium

What this source supports

  • Proofpoint independently observed TA2721 delivering Bandook through Spanish-language PDF-link-encrypted-RAR chains during 2021
  • Proofpoint observed South American, often Venezuelan or Mexican, company impersonation and published a Caracas-themed sample and independent infrastructure/hashes
  • Proofpoint says ESET first published details of the malware used by this group
  • Proofpoint does not independently validate ESET's 90% or more-than-200 figures, and the evidence does not justify replacing the unknown operator with TA2721 across the historical Bandidos campaign

Evidence limits

Primary independent telemetry for closely related 2021 Bandook delivery. It does not name a successfully compromised Venezuelan organization or prove that TA2721 operated every Bandidos sample since 2015.

Relevance to this case

Independent technical corroboration for tradecraft and Venezuelan relevance, carefully bounded against identity conflation.

Bandidos At Large — Indicators of Compromise

ESET Research (GitHub) Jul 5, 2021
Corroborating Public record Source confidence: High

What this source supports

  • ESET published reproducible Bandidos/Bandook sample hashes, detection names, IP addresses and domains
  • the repository explicitly links the indicators to ESET's analysis targeting Venezuela
  • the IOC set improves technical traceability but remains part of the same ESET investigation and identifies no victim

Evidence limits

Primary technical artifact but same-publisher support; indicators do not establish installation, exfiltration or impact at a named Venezuelan organization.

Relevance to this case

Adds exact reproducible indicators and publication provenance for the ESET analysis.