MEXICAN BANKS AND CRYPTOCURRENCY PLATFORMS TARGETED WITH ALLAKORE RAT

Summary from the TLDR InfoSec newsletter

A financially motivated threat actor is targeting Mexican banks and cryptocurrency trading entities with a modified version of the AllaKore RAT. The RAT payload allows the threat actors to send stolen banking credentials and authentication information to a command-and-control server for financial fraud. Based on the large number of Mexico Starlink IPs used in the campaign and the addition of Spanish-language instructions to the modified RAT payload, the threat actor is believed to be based in Latin America.