A new hacker-for-hire mercenary group is detected with ties to attacks targeting victims all over the world. The group named CostaRicto, is the fifth hacker-for-hire group discovered this year. Details about CostaRicto’s current origins and whereabouts still remain unknown. The group has orchestrated attacks all over the globe across different countries in Europe, the Americas, Asia, Australia, and Africa. However, the biggest concentration of victims appears to be in South Asia, and especially India, Bangladesh, and Singapore, suggesting that the threat actor could be based in the region. The victims’ profiles are diverse across several verticals, with a large portion being financial institutions. The group is using custom-built and never-before-seen malware, however they are not operating using any innovative techniques. Most of their attacks rely on stolen credentials or spear-phishing emails as the initial entry vector. These emails usually deliver a backdoor trojan named Sombra or SombRAT. The backdoor trojan allows CostaRicto operators to access infected hosts, search for sensitive files, and exfiltrate important documents. This data is usually sent back to CostaRicto command-and-control infrastructure, which is usually hosted on the dark web, and accessible only via Tor. Furthermore, the infected hosts usually connect these servers via a layer of proxies and SSH tunnels to hide the malicious traffic from the infected organizations.