New Banking Trojan Target Organizations in Spain and Mexico

Share post:

Attackers are targeting organizations in Spain and Mexico with new Grandoreiro banking trojan. The attackers target the automotive, civil and industrial construction, logistics and machinery sectors via several infection chains in Mexico and chemicals manufacturing industries in Spain.

The attackers target these organizations via spear-phishing emails written in Spanish in order to induce the victims to click on a malicious link. The link retrieves a ZIP archive from which a loader is extracted. To run the trojan, the loader is used, which pretends to be a PDF file.

“This [loader] is responsible for downloading, extracting and executing the final 400MB ‘Grandoreiro’ payload from a Remote HFS server which further communicates with the [command-and-control] Server using traffic identical to LatentBot,” said Zscaler researcher Niraj Shivtarkar.

In addition to running the trojan, the loader also collects information, retrieves a list of installed antivirus solutions, cryptocurrency wallets, banking and email apps, and exfiltrates the information to a remote server.

Findings from security researchers suggest that Grandoreiro is rapidly evolving into sophisticated malware with novel anti-analysis properties that offers attackers full remote access and poses significant threats to employees and their organizations.

The sources for this piece include an article in TheHackerNews.

SUBSCRIBE NOW

Related articles

London hospitals cancel over 800 operations after ransomware attack

NHS England disclosed today that a recent ransomware attack on Synnovis has led to the cancellation of hundreds...

Microsoft cancels universal Recall release in favor of Windows Insider preview

Microsoft has decided to cancel the wide release of Recall, the controversial tool for Copilot+ PCs, and instead...

Cyber Security Today, Week in Review for week ending Friday, June 14, 2024

Welcome to Cyber Security Today. This is the Week in Review for the week ending Friday, June 14th,...

Cyber Security Today, June 14, 2024 – Employee downloaded a file that led to hospital chain’s ransomware attack

An employee downloaded a file that led to hospital chain's ransomware attack Welcome to Cyber Security Today. It's Friday...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways