Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-06 00:55:37 UTC
Home > List all groups > List all tools > List all groups using tool CarnavalHeist
 Tool: CarnavalHeist
Names CarnavalHeist
Category Malware
Type Banking trojan
Description
(Talos) Talos assesses with high confidence that the CarnavalHeist malware is of Brazilian
origin and primarily targets Brazilian users based on our observations of the Portuguese
language being used throughout all aspects of the infection chain and the malware itself,
including the use of Brazilian slang to describe some bank names, and a notable lack of other
language variants thus far. The command and control (C2) infrastructure exclusively uses the
BrazilSouth availability zone on Microsoft Azure to control infected machines, and they
specifically target prominent Brazilian financial institutions.
Information Last change to this tool card: 19 June 2024
Download this tool card in JSON format
All groups using tool CarnavalHeist
Changed Name Country Observed
Unknown groups
 _[ Interesting malware not linked to an actor yet ]_
1 group listed (0 APT, 0 other, 1 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=136242a6-310c-466b-98a7-5c7cf9888bfc
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=136242a6-310c-466b-98a7-5c7cf9888bfc
Page 1 of 1