Financial institutions across Latin America are currently facing a significant surge in malware activity driven by a sophisticated remote access trojan. According to The Hacker News, the JanelaRAT malware family has conducted 14,739 documented attacks in Brazil throughout 2025, specifically focusing on the banking and cryptocurrency sectors. While Brazil remains the primary epicenter of this activity, organizations in Mexico have also been identified as high-priority targets for this campaign.
Technical Analysis of the JanelaRAT Variant
JanelaRAT is a modified version of the older BX RAT source code, adapted to bypass modern security controls and focus on regional financial targets. The name “Janela”—the Portuguese word for window—refers to the malware’s TTP of monitoring active window titles on an infected host. By tracking which applications are currently in the foreground, the malware can trigger specific payloads when a user interacts with a banking portal or a cryptocurrency wallet.
Technically, the malware is highly versatile. It possesses the capability to log keystrokes, track mouse inputs, and take periodic screenshots of the victim’s desktop. This functionality allows the threat actors to capture multi-factor authentication codes and private keys in real-time. Furthermore, JanelaRAT collects extensive system metadata, which it exfiltrates to its C2 infrastructure to help the attackers determine the value of the compromised host. This metadata typically includes hardware specifications, installed software lists, and network configuration details.
Targeting Mechanics in Latin America
The campaign demonstrates a clear geographic and sectoral focus. The threat actors utilize localized Phishing lures or malicious downloads that appear relevant to Brazilian and Mexican users. Once the initial infection is established, the malware maintains persistence and waits for the user to access specific financial URLs. Unlike some APT groups that focus on long-term espionage, the operators of JanelaRAT appear motivated by immediate financial gain through the draining of bank accounts and crypto assets.
How to Detect JanelaRAT Attacks
Defenders should prioritize visibility into process behavior and network anomalies. Because JanelaRAT is a BX RAT variant, SIEM rules should be configured to flag suspicious outbound traffic to unknown IP addresses that do not align with standard business operations. Furthermore, EDR solutions should be tuned to alert on unauthorized attempts to hook into window management APIs or unexpected screen-capture activities initiated by unsigned binaries.
Security teams can improve their posture by searching for specific IoC signatures associated with the BX RAT family. Organizations should audit their environments for the presence of unexpected DLL injections and monitor for the exfiltration of structured system metadata. Understanding these patterns is essential for any SOC attempting to mitigate the risk of financial fraud.
Mitigation and Defense Strategies
To defend against this threat, a layered security approach is mandatory. Organizations must implement the following controls:
- Endpoint Hardening: Restrict the execution of unsigned scripts and binaries that attempt to interface with sensitive system APIs.
- Network Segmentation: Ensure that workstations used for financial transactions are isolated from general internet browsing to reduce the risk of initial infection.
- User Awareness: Provide localized training for employees in the LATAM region regarding the specific phishing lures used to distribute BX RAT variants.
- Framework Alignment: Map detected behaviors to the MITRE ATT&CK framework to identify gaps in current detection capabilities, specifically focusing on Input Capture (T1056) and Screen Capture (T1113).
By focusing on these technical controls, financial institutions can better defend against the high volume of JanelaRAT activity currently observed in the region.