TA2725
TA2725 is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets the Finance sector in 3 countries, including Brazil and Spain. It uses 1 MITRE ATT&CK technique.
- Techniques
- 1
- Exploited CVEs
- No CVE data
- First seen
- Mar 1, 2022
- Last seen
- Aug 29, 2023
- Record updated
Who They Target.
About TA2725.
TA2725 is a threat actor that has been tracked since March 2022. They primarily target organizations in Brazil and Mexico using Brazilian banking malware and phishing techniques. Recently, they have expanded their operations to also target victims in Spain and Mexico simultaneously. TA2725 typically uses GoDaddy virtual hosting for their URL redirector and hosts malicious files on legitimate cloud hosting providers like Amazon AWS, Google Cloud, or Microsoft Azure. They have been known to spoof legitimate companies, such as ÉSECÈ Group, to deceive their victims.
Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.