Water Curupira Pikabot Distribution installation via JavaScript will launch follow-on commands via cmd.exe.2
campaign
Water Curupira Pikabot Distribution C0037
- First seen
- January 2023
- Last seen
- December 2023
- Created
- 17 July 2024
- Last modified
- 31 July 2026
Pikabot was distributed in Water Curupira Pikabot Distribution throughout 2023 by an entity linked to BlackBasta ransomware deployment via email attachments. This activity followed the take-down of QakBot, with several technical overlaps and similarities with QakBot, indicating a possible connection. The identified activity led to the deployment of tools such as Cobalt Strike, while coinciding with campaigns delivering DarkGate and IcedID en route to ransomware deployment.[1]
10
Techniques32nd pct
5
TacticsBottom 25%
3
Tools & malware66th pct
0
Threat groupsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference C0037
Water Curupira Pikabot Distribution initial delivery included obfuscated JavaScript objects stored in password-protected ZIP archives.3
Water Curupira Pikabot Distribution used Curl.exe to download the Pikabot payload from an external server, saving the file to the victim machine's temporary directory.4
Water Curupira Pikabot Distribution used highly obfuscated JavaScript files as one initial installer for Pikabot.5
Water Curupira Pikabot Distribution requires users to interact with malicious attachments in order to start Pikabot installation.6
Water Curupira Pikabot Distribution distributed a PDF attachment containing a malicious link to a Pikabot installer.7
Standing C0037
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques1032nd pct
32nd percentile · 68% of 56 ATT&CK campaigns have more Enterprise techniques.
Tactics5Bottom 25%
25th percentile · 75% of 56 ATT&CK campaigns have more tactics spanned.
Tools & malware366th pct
66th percentile · 66% of 56 ATT&CK campaigns have this many tools and malware or fewer.
Threat groups055% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique46.5medTop 2%
98th percentile · 98% of 56 ATT&CK campaigns have this many detection rules per technique or fewer.
Tests / technique4med
Detection coverage C0037
437 distinct rules cover the 10 techniques recorded for this campaign. The 472 technique-to-rule mappings resolve to 437 distinct rules, because one rule can cover several techniques. 270 Sigma · 167 Splunk.
10 covered by at least one rule437 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org