Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Ousaban Banking Trojan Targets Spain and Portugal With Geofenced Phishing Campaign
Excerpt
A highly targeted phishing campaign spreading the Ousaban banking trojan to users in Spain and Portugal. Historically active in Brazil, this updated malware uses advanced geofencing, steganography, and daily-changing command-and-control domains to evade detection. The attack begins with a deceptive PDF and ultimately grants attackers full remote control over the victim’s machine, allowing them to steal sensitive financial data. Ousaban Geofenced Phishing Campaign The…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability
Victim
Attack Flow8 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | facture-in.pages.dev | High | Score 58/100 | First seen |
| Domain | facture-arsys.duckdns.org | High | Score 64/100 | First seen |
| Domain | faturanova.xyz | High | Score 64/100 | First seen |
IOC Relationship Graph
Building graph…