CYBER THREAT INTELLIGENCE LATIN AMERICA · Strategic intelligence on digital financial fraud Read the blog
Independent editorial research · Latin America

Atlas LATAM · naming

Family naming and aliases

A family can appear under several names depending on the vendor, variant or time of analysis. Use this reference to move from a name cited in a source to the Atlas canonical family. Before treating two names as equivalent, review the documented relationship and the primary source.

Alias ≠ attribution; correlation ≠ identity. A shared name or an overlap flagged by a vendor does not prove that it is the same code or the same actor.

54 cited terms and notes · 35 canonical families · 12 vendors named in the sources

Open the explorer → See the map by country →

How to use this page

From a name cited in a source to the canonical family.

1 · Search the name
Type the name as it appears in the source: a vendor name, a cluster code (for example REF9334) or a variant. The search also finds the canonical family and the notes.
2 · Read the card
Each card separates cited names from relationships and notes (variants, forks, overlaps). When the source names the vendor, it appears next to the term.
3 · Check the profile
Before treating two names as the same threat, open the profile in the Explorer and review the primary source: the equivalence may be partial or flagged by a single vendor.

35 of 35 families · 54 of 54 terms

A

Antidot

Android

Cited names

  • AppLite per ZimperiumAntiDot variant

Documented countries

Region "LATAM" (declared)

Declared region only: the dataset names no specific country.

Outside Latin America

SpainPortugalFranceGermanyRussiaRomania

B

BRATA

Android

Cited names

  • AmexTroll
  • Copybara

Relationships and notes

  • Treated separately per ThreatFabric

Documented countries

No country documented in the dataset

According to the primary source

Read in the cited source; not part of the 2026-09-29 dataset or the map counts.

C

D

G

Ghimob

Android

Cited names

  • Guildma per Kaspersky

Relationships and notes

  • Mobile branch of Tetrade

Documented countries

BrazilPeruParaguay

Outside Latin America

PortugalGermanyAngolaMozambique

H

Hook

Android

Relationships and notes

  • Fork of Ermac per ThreatFabric
  • Not a fork of Octo

Documented countries

Region "LATAM" (declared)

Declared region only: the dataset names no specific country.

According to the primary source

  • ArgentinaChileColombiaMexicoPeruUruguay — per ThreatFabric ↗ (banks named in the target-app list)

Read in the cited source; not part of the 2026-09-29 dataset or the map counts.

J

K

L

Lucid

PhaaS

Cited names

  • LARVA-242 per THN
  • XinXin

Relationships and notes

  • Overlap with Darcula and Lighthouse per THN

Documented countries

No Latin American country in the dataset (see "Outside Latin America")

Outside Latin America

United KingdomUnited StatesRegion "Europe" (declared)

M

N

P

R

Rocinante

Android

Cited names

  • Pegasus
  • PegasusSpyinternal name used by the actor; not NSO’s Pegasus

Documented countries

No country documented in the dataset

According to the primary source

Read in the cited source; not part of the 2026-09-29 dataset or the map counts.

S

SpyLoan

Android

Cited names

  • Android/SpyLoan
  • KreditSpy per ESET

Documented countries

No country documented in the dataset

According to the primary source

  • MexicoColombiaPeru outside the region: IndonesiaThailandVietnamIndiaPakistanPhilippinesEgyptKenyaNigeriaSingapore — per ESET ↗ (ESET telemetry)

Read in the cited source; not part of the 2026-09-29 dataset or the map counts.

T

V

W

Water Saci

Windows / PoS

Cited names

  • SORVEPOTELmalware

Relationships and notes

  • Ecosystem later linked to TCLBANKER per Elastic
  • Campaign name per Trend

Documented countries

Brazil

Outside Latin America

Portugal

X

Z

Method and scope

How this reference is built and what it does not allow you to conclude.

  • Origin: the Atlas LATAM master index. No equivalences are added that the index does not cite, and none are inferred from code or name similarity.
  • Vendor: shown only when the source names it in the entry itself. Otherwise the term appears without a vendor; it is not filled in by deduction.
  • Confidence: if a name appears here, at least one source uses it for that family. Relationships such as variant, fork or overlap reflect the cited source; they are not this site’s own attribution.
  • Repeated entries: if the same equivalence appears more than once, it is shown once while preserving the cited vendors.
  • Absence ≠ no alias: only what is documented at the cutoff is listed.

Missing a name or found an error? Write to us via contact with the source; corrections are logged in corrections.

Data as of 2026-09-29 · dataset version sha256:4d26f99cb6cb2addcc561e2304de6b774f003ba9d01b1f2a8c3c417da8a7512a

Authorship and license

Ezequiel Jorge La Terra · ORCID 0009-0008-1677-4218 · Text licensed under CC BY 4.0.

How to cite: La Terra, E. J. (2026). Family naming and aliases. Cyber Threat Intelligence LATAM. 2026-09-29. https://cyberthreatintelligence.lat/en/aliases/

Related reports and analysis

Find the context, sources and limits of these threats in the reports and articles on this site.

Read the reports Read the analysis