Threat Intelligence / Actor / REF3076 operator (Brazilian-Portuguese-speaking, financially motivated)

REF3076 operator (Brazilian-Portuguese-speaking, financially motivated)

1 tracked threat(s) · Categories: MALWARE

Also known as: REF3076, MAVERICK operators, SORVEPOTEL operators, Water Saci (overlap)

Tracked threats

TCLBANKER Brazilian Banking Trojan — Trojanized Logi AI Prompt Builder DLL Sideload with WhatsApp and Outlook Worm Modules (REF3076) — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence