Threat actorBrazilTracked since 2026-03

Horabot Operators

Also known as:Horabot GroupSapecar Operators

As of 2026-05-30, Horabot Operators is a Brazil-nexus threat actor tracked by Threadlinqs Intelligence across 1 threat spanning malware. Also known as Horabot Group, Sapecar Operators.

Tracked threats: 11 high
First seen: 2026-032026-03-18
Last seen: 2026-032026-03-18
ATT&CK techniques: —No mapped techniques yet
Related CVEs: 0None referenced
Attribution: BrazilNation or origin

Nation: Brazil · 1 tracked threat(s) · Categories: MALWARE

Activity timeline

Horabot Operators appears in 1 tracked threat between 2026-03-18 and 2026-03-18.

Tracked threats

Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico with Multi-Stage Loader and Email SpreaderHIGH2026-03-18