Caliente Bandits
Aliases: TA2721
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- team
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:12:11
Targeted industries: financial-services media-and-entertainment
Context
Caliente Bandits is a highly active threat group that targets multiple industries, including finance and entertainment. They distribute the Bandook remote access trojan using Spanish-language lures through low-volume email campaigns. The group primarily impacts individuals with Spanish surnames and conducts reconnaissance to obtain employee data. They masquerade as companies in South America and use Hotmail or Gmail email addresses.
Reports & references
- proofpoint.com — New Threat Actor Uses Spanish Language Lures Distribute Seldom Observed Bandook (report)