A new spear phishing campaign is targeting Mexican financial institutions in order to deliver a new version of the Allakore remote access trojan (RAT). According to researchers, this campaign has been using Mexican Social Security Institute naming conventions and legitimate documents to initiate the payload. To load the malware, the threat actors begin with a zip file that is uploaded to the target network via a phishing email or some other drive-by compromise involving legitimate files. Once loaded and installed Allakore RAT has some of the typical trojan signatures, including the abilities to execute keystroke logging, exfiltrate files, and in some cases take control of a device through privilege escalation. This updated version of Allakore includes additional abilities that specifically target financial and cryptocurrency services, including bringing in and executing additional payloads. Typically, the targets of these attacks are directed at corporations that gross over $100 million annually from a wide variety of sectors, both public and private. This campaign has been seen utilizing Mexico Starlink IP addresses, which combined with the new Spanish instructions within the updated Allakore RAT lead researchers to believe this is a currently unknown Latin American threat actor. Ankura will continue to monitor the evolution of this campaign as it progresses.