Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud

Key takeaways

An MDR investigation correlated attacker infrastructure and endpoint telemetry to map the full operational model of Banana RAT, a banking trojan attributed to a threat activity cluster that TrendAI™ tracks as SHADOW-WATER-063. By correlating artifacts like recovered server tooling and client payloads, TrendAI Vision One™ Services – Managed Detection and Response (MDR) reconstructed the full attack chain, from polymorphic payload generation and staged delivery to in-memory execution and encrypted C&C communication.

The malware uses layered obfuscation, AES-wrapped payloads, and fileless PowerShell execution to evade detection and persiste…