Grandoreiro, the banking trojan that was dismantled in January this year, is back with a vengeance. This is according to a new report from IBM’s cybersecurity arm, X-Force, which claims the trojan has been updated, and is now targeting a much wider area.
In late January this year, the Federal Police of Brazil, together with Interpol, the Spanish National Police, ESET, and Caixa Bank, dismantled the trojan operation, arrested five people, and made 13 search and seizure operations across Brazil.
At the time, it was said that Grandoreiro existed for seven years and primarily targeted Spanish-speaking nations.
Updates to the malware
Now, IBM’s X-Force said it spotted a new campaign, which started in March this year. For now, the goal is simply to deploy the trojan to as many victims as possible, and to that end, the attackers use a malware-as-a-service model. More than 1,500 banks around the world are targeted, located in 60 countries around the world (Central and South America, Africa, Europe, and the Indo-Pacific region).
It is also worth mentioning that the malware actively avoids endpoints in countries such as Russia, Czechia, Poland, and the Netherlands, and that it doesn’t run on Windows 7 devices located in the US, sporting no antivirus programs.
Besides attacking more people, Gradoreiro was also updated.
“Analysis of the malware revealed major updates within the string decryption and domain generating algorithm (DGA), as well as the ability to use Microsoft Outlook clients on infected hosts to spread further phishing emails,” the researchers explained.
“In order to interact with the local Outlook client, Grandoreiro uses the Outlook Security Manager tool, a software used to develop Outlook add-ins,” the researchers said. “The main reason behind this is that the Outlook Object Model Guard triggers security alerts if it detects access on protected objects.”
As usual, the best way to defend against these attacks is to be vigilant with all incoming email messages.
Via The Hacker News
