Cleafly researchers have observed the threat actor behind the “BRATA” banking trojan advancing the malware’s capabilities and noted that the group’s recent activity is now categorized as Advanced Persistent Threat (APT) activity. This categorization is due to the group’s latest campaigns that included establishing “a long-term presence on a targeted network to steal sensitive information.” Researchers detailed that the threat group behind BRATA is very targeted, as it focuses on only one (1) financial institution at a time and pivots only when the victim establishes effective countermeasures that are consistent. The latest BRATA variant has been updated with new phishing techniques, information-stealing capabilities, new classes to obtain GPS data, overlay abilities (which allows the malicious application to display over other apps on a device), SMS sending and receiving capabilities, and device management permissions on the targeted device as well as sideloading a second stage payload from its command-and-control (C2) server in order to perform Event Logging. The BRATA variant has been observed targeting specific banking institutions across Europe and mimicking a login webpage of the targeted bank in an analyzed phishing campaign. Many of the malware’s updated features are still under development and Cleafly researchers concluded that the threat actor is updating BRATA in order to abuse the Accessibility Service on devices and gain additional data from other applications. A further in-depth analysis of the latest upgrades as well as indicators of compromise (IOCs) can be viewed in Cleafly’s report linked below.