Arctic Wolf Labs has identified a financially motivated threat group dubbed Greedy Sponge, which has been active since early 2021, primarily targeting Mexican organizations. This group employs modified versions of the AllaKore RAT and SystemBC malware, focusing on financial fraud. The AllaKore RAT has been significantly altered to capture banking credentials and unique authentication data, enabling the attackers to exfiltrate sensitive information to their command-and-control (C2) server. The recent campaigns include deploying custom installers that contain the modified RAT and utilizing SystemBC as a secondary tool for further exploitation. Greedy Sponge's operational tactics have evolved, particularly since mid-2024, with enhancements in geofencing methods that restrict their activities to the Mexican region. Previously, geofencing checks were performed at the initial stage using a .NET downloader, but these checks have now been moved server-side to complicate detection efforts.