On September 30 and October 1, detections and reports indicated massive message deliveries to multiple WhatsApp users in Brazil. The messages prompted recipients to open, via WhatsApp Web or the desktop application, an attached ZIP file. Initially, information about the incidents was limited, with only a few indicators linked to two main domains: zapgrande[.]com and sorvetenopote[.]com.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
As evidence accumulated, we identified behavior consistent with a worm. Once the victim was infected, the mechanism leveraged the contact list in the application to resend the same message and attachment to additional users. This propagation pattern enabled rapid dissemination within the first 24 hours of the event.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
Upon infection, clicking the attachment triggered the execution of an encoded PowerShell command responsible for downloading and running code in memory — a fileless technique. All activity originated from infrastructure hosted on one of the associated domains.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
In parallel, another detected PowerShell command attempted to create exclusions in the host’s protection mechanism (Microsoft Defender). The procedure involved adding a process to the antivirus exclusion list, indicating a deliberate attempt to reduce local defense visibility.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<h2 aria-level="2">The iT.eam CTI Team’s Response to the WhatsApp Attacks<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </h2>
Following the first detections, iT.eam’s Cyber Threat Intelligence (CTI) team immediately initiated preventive procedures:<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<ul>
<li>Creation and deployment of rules in the SIEM and security tools to capture known IOCs<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </li>
<li>Blocking of malicious domains and URLs<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </li>
<li>Continuous pivoting to identify additional domains and infrastructure connected to the attackers<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </li>
</ul>
This effort enriched our rule sets and reference lists, expanding detection coverage and enabling more robust correlation capabilities.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<h2 aria-level="2">Technical Behavior Analysis <span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </h2>
During malicious execution, a BAT file was created in the user’s startup folder, with no apparent persistent modifications to system registry keys. Alongside this BAT file, multiple JavaScript scripts were added, acting as follows within the context of WhatsApp Web:<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<ol>
<li>The malware checked for active sessions<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </li>
<li>It repeatedly sent the attached file to contacts in the active session<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </li>
<li>It maintained regular communication with the domain zapgrande[.]com<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </li>
</ol>
This domain operated as a command-and-control (C2) server, as evidenced by captured traffic during network analysis.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
Despite its broad propagation, the worm’s behavior proved relatively simple from a technical standpoint — reinforcing a critical point: social engineering and user curiosity remain decisive infection vectors. Even low-sophistication malware can cause significant impact when anchored in real contact lists and well-targeted social engineering campaigns.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<h3 aria-level="3">Tactis, Techniques, and Procedures (TTPs) Identified<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> in the WhatsApp Attacks</h3>
Below are some of the TTPs associated with this threat:<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<ul>
<li>Initial Acess: TA0001 
Phishing: T1566<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </li>
<li>Execution: TA0002 
Command and Scripting Interpreter: PowerShell: T1059.001<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </li>
<li>Defense Evasion: TA0005 
Obfuscated Files or Information: Command Obfuscation: T1027<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </li>
<li>Command and Control (C2): TA0011<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </li>
</ul>
<h2 aria-level="2">The Importance of a Mature CTI Team<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> </h2>
It is common to assume that campaigns of this nature begin with random number searches. However, the investigation conducted by iT.eam’s CTI team revealed a more sophisticated and opportunistic pattern.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
Throughout September 2025, there was a significant increase in the availability and exposure of Brazilian customer databases. Free samples containing between 1,000 and 5,000 records were frequently shared in forums and online groups.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
Many of these data breaches were directly or indirectly linked to actors operating in Russian-language forums, both on the clearnet and in more restricted environments such as the dark web and Telegram channels. From these datasets, malicious actors can extract phone numbers, email addresses, and other valuable metadata for targeted campaigns — facilitating the success of phishing schemes and self-propagating worms.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
The investigation into this incident clearly demonstrates the strategic importance of having a mature and integrated Cyber Threat Intelligence. CTI goes beyond collecting IOCs — it transforms scattered indicators into actionable intelligence, enables smarter response prioritization, and significantly reduces the time between detection and containment. In the specific case of the WhatsApp attacks that began on September 30, 2025, the integrated efforts of collection, analysis, and dissemination of intelligence were crucial to mitigating the overall impact.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
Want to protect your organization from attacks like those that targeted WhatsApp? <a href="https://it-eam.com/contact">Contact our specialists</a> to learn more about the work carried out by iT.eam’s CTI team!<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:false,&quot;134245529&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}"> 
<a href="https://blog.it-eam.com/wp-content/uploads/2025/10/Gabriel-Alves_Autoria_ENG-scaled.png"><img decoding="async" class="alignnone wp-image-7768 size-medium" src="https://blog.it-eam.com/wp-content/uploads/2025/10/Gabriel-Alves_Autoria_ENG-300x82.png" alt="Photo of Gabriel Alves, Cyber Threat Intelligence Trainee at iT.eam, on a red background with name and title displayed." width="300" height="82" srcset="https://blog.it-eam.com/wp-content/uploads/2025/10/Gabriel-Alves_Autoria_ENG-300x82.png 300w, https://blog.it-eam.com/wp-content/uploads/2025/10/Gabriel-Alves_Autoria_ENG-1024x281.png 1024w, https://blog.it-eam.com/wp-content/uploads/2025/10/Gabriel-Alves_Autoria_ENG-768x210.png 768w, https://blog.it-eam.com/wp-content/uploads/2025/10/Gabriel-Alves_Autoria_ENG-1536x421.png 1536w, https://blog.it-eam.com/wp-content/uploads/2025/10/Gabriel-Alves_Autoria_ENG-2048x561.png 2048w, https://blog.it-eam.com/wp-content/uploads/2025/10/Gabriel-Alves_Autoria_ENG-scaled.png 1920w" sizes="(max-width: 300px) 100vw, 300px" /></a>

Check out iT.eam’s CTI team analysis of the recent WhatsApp attacks and the malware’s propagation!

Capa blogpost

On September 30 and October 1, detections and reports indicated massive message deliveries to multiple WhatsApp users in Brazil. The messages prompted recipients to open, via WhatsApp Web or the desktop application, an attached ZIP file. Initially, information about the incidents was limited, with only a few indicators linked to two main domains: zapgrande[.]com and [&hellip;]

Attacks on WhatsApp and Their Connection to Frequent Data Breaches