Unveiling the Global Threat: ‘Grandoreiro’ Trojan Strikes Banking Users Everywhere

Brazilian Banking Malware Spreads to Spain, Highlighting Growing Latin American Cybercrime

Introduction

The Brazilian banking malware known as “Grandoreiro” has made its way to Spain, expanding the reach of Latin American cybercrime. This comes as dark web activity in the region has surged in recent years, with Mexico and Brazil being the most heavily targeted countries. The cybercrime group TA2725, which Proofpoint has been tracking since March 2022, has upgraded its malware to target institutions on both sides of the Atlantic. This development follows a growing trend where Brazilian malware is no longer confined to a single continent.

The Mechanics of Grandoreiro

Grandoreiro launches attacks by using malicious URLs in phishing emails. The lures can take the form of fake shared documents, utility bills, tax forms, and more. Clicking on the URL leads to a ZIP file that contains a loader. When executed, the loader downloads a legitimate but vulnerable application. Exploiting the application using DLL sideloading enables the final payload of the malware to be delivered. Grandoreiro can harvest data using a keylogger, screen grabber, or an overlay on top of an online banking login page. In recent campaigns, the overlays have been designed to mimic popular Brazilian and Mexican banks, as well as banks in Spain.

Expanding Trend: Brazilian Malware Crossing Oceans

The recent spread of Brazilian trojans to Spain is not an isolated incident. Earlier this year, Brazilian threat actors targeted Portuguese bank customers in a campaign known as “Operation Magalenha.” This emerging trend suggests that Brazilian malware is no longer limited to one continent.

The Reasons Behind Brazil’s Cybercrime Boom

The rise of banking trojans in Brazil can be attributed to several factors. Jared Peck, a senior threat researcher at Proofpoint, points out that cybersecurity education and protective technologies have not been widely accessible in many parts of South America, including Brazil. Despite this, the online presence of the general population continues to grow, leading to a lack of user awareness regarding phishing and malware threats. Consequently, a larger number of victims fall prey to these attacks. Furthermore, Brazil’s growing middle class and increasing upward mobility provide cybercriminals with a larger pool of potential victims.

Families of Malware and Fighting Back

Notably, Grandoreiro is not the only Brazilian malware impacting the region. Other common malware families include Casabeniero, Javali, and Mekotio, which all share a common lineage originating from a Delphi-based ancestor. Source code components have been passed down and modified through generations, resulting in the creation of these different malware variants. Organizations in affected countries should watch out for suspicious programs that exhibit similar elements. Additionally, Peck emphasizes the importance of focusing on the human aspect of combating cyber threats. Organizations must provide localized user security awareness training to help users identify malicious phishing attempts and understand threat actor tactics and techniques. It is also crucial to empower users to feel comfortable reporting suspicions, even after falling victim to an attack.

Editorial

The spread of Brazilian banking malware to Spain highlights the increasing threat of Latin American cybercrime on a global scale. It is evident that cybercriminals are capitalizing on the lack of cybersecurity education and protective technologies in certain regions, leading to a larger pool of unsuspecting victims. As the online presence of populations in developing countries grows, it is crucial to prioritize cybersecurity awareness and education. Governments, organizations, and individuals must invest in initiatives that improve cybersecurity literacy to combat the evolving tactics employed by cybercriminals.

However, it is equally important to recognize that technology alone cannot solve the cybercrime problem. The human element, including user awareness and the willingness to report suspicions, plays a crucial role. Organizations must prioritize localized user security awareness training that educates users on identifying and reporting phishing attempts. Creating a culture of reporting and learning from security incidents helps create a resilient defense against cyber threats.

Advice on Combating Cybercrime

Individuals and organizations should take several measures to protect themselves from banking malware and other cyber threats:

1. Stay Vigilant Against Phishing Emails

Be cautious when receiving unexpected emails or messages. Do not click on suspicious links or download attachments from unknown sources.

2. Keep Software Up to Date

Regularly update all software installed on your devices, including operating systems, applications, and security programs. Patching vulnerabilities helps prevent exploitation by malware.

3. Use Multi-Factor Authentication

Enable multi-factor authentication whenever possible, especially for online banking and other critical accounts. This additional layer of security makes it harder for cybercriminals to gain unauthorized access.

4. Invest in Cybersecurity Awareness Training

Organizations should provide localized user security awareness training to educate employees about phishing and other threat actor tactics. Encourage them to report suspicious activities and empower them to feel comfortable doing so even after falling victim to an attack.

5. Implement Strong Password Policies

Adopt password policies that require the use of strong and unique passwords. Encourage employees and individuals to use password managers to securely store their credentials.

6. Regularly Back Up Data

Backup critical data regularly and store backups in separate locations. This helps mitigate the impact of ransomware attacks and other forms of data loss.

7. Stay Informed and Updated

Keep up to date with the latest cybersecurity news, trends, and best practices. This knowledge equips individuals and organizations with the information needed to stay one step ahead of cybercriminals.

By following these practices and adopting a holistic approach to cybersecurity that combines technical safeguards with human awareness and vigilance, individuals and organizations can better protect themselves against the growing threat of cybercrime.