Water Kappa
Water Kappa is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets the Technology and Finance sectors in Japan. It uses 7 MITRE ATT&CK techniques.
- Techniques
- 7
- Exploited CVEs
- No CVE data
- First seen
- Aug 9, 2021
- Last seen
- Aug 9, 2021
- Record updated
Who They Target.
Sectors · 2
Countries · 1
How They Operate · MITRE ATT&CK.
7 techniques across 4 of 14 tacticsReconnaissance·
Resource Development·
Initial Access1
T1204.002
User Execution: Malicious File
User Execution: Malicious File
Execution2
T1218.011
System Binary Proxy Execution: Rundll32
System Binary Proxy Execution: Rundll32
T1574.002
Hijack Execution Flow: DLL Side-Loading
Hijack Execution Flow: DLL Side-Loading
Persistence·
Privilege Escalation·
Defense Evasion3
T1027
Obfuscated Files or Information
Obfuscated Files or Information
T1036.005
Masquerading: Match Legitimate Resource Name or Location
Masquerading: Match Legitimate Resource Name or Location
T1090.003
Proxy: Multi-hop Proxy
Proxy: Multi-hop Proxy
Credential Access1
T1056.001
Input Capture: Keylogging
Input Capture: Keylogging
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- Cinobimalware
- Bottletool
- Tortool
Campaigns.
- Operation OvertrapAug 2021
Indicators Of Compromise.
TLP:AMBER30 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Water Kappa.
A financially motivated cybercriminal threat group known for targeting Japanese users and financial entities with the Cinobi banking trojan using exploit kits and malvertising.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.