CybercrimeFinancial
Water Makara
Water Makara is a cybercrime syndicate with a financial motive, tracked by Brandefense. It uses 10 MITRE ATT&CK techniques.
- Techniques
- 10
- Exploited CVEs
- No CVE data
- Record updated
How They Operate · MITRE ATT&CK.
10 techniques across 5 of 14 tacticsResource Development·
Initial Access3
T1078
Valid Accounts
Valid Accounts
T1204.002
User Execution: Malicious File
User Execution: Malicious File
T1566.001
Phishing: Spearphishing Attachment
Phishing: Spearphishing Attachment
Execution3
T1059.005
Command and Scripting Interpreter: Visual Basic
Command and Scripting Interpreter: Visual Basic
T1059.006
Command and Scripting Interpreter: Python
Command and Scripting Interpreter: Python
T1059.007
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: JavaScript
Persistence·
Privilege Escalation·
Defense Evasion·
Credential Access1
T1537
Transfer Data to Cloud Account
Transfer Data to Cloud Account
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration1
T1041
Exfiltration Over C2 Channel
Exfiltration Over C2 Channel
Impact·
Arsenal · Malware And Tools.
- Astarothmalware
- Maverickmalware
- Metamorfomalware
- PowerShelltool
- Pythontool
- VBScripttool
Campaigns.
- Boto Cor-de-Rosa
About Water Makara.
A threat cluster observed in 2024 relying on phishing emails for Astaroth propagation.
Last updated Jul 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.