New Banking Trojan Target Organizations in Spain and Mexico

Attackers are targeting organizations in Spain and Mexico with new Grandoreiro banking trojan. The attackers target the automotive, civil and industrial construction, logistics and machinery sectors via several infection chains in Mexico and chemicals manufacturing industries in Spain.

The attackers target these organizations via spear-phishing emails written in Spanish in order to induce the victims to click on a malicious link. The link retrieves a ZIP archive from which a loader is extracted. To run the trojan, the loader is used, which pretends to be a PDF file.

“This [loader] is responsible for downloading, extracting and executing the final 400MB ‘Grandoreiro’ payload from a Remote HFS server which further communicates with the [command-and-control] Server using traffic identical to LatentBot,” said Zscaler researcher Niraj Shivtarkar.

In addition to running the trojan, the loader also collects information, retrieves a list of installed antivirus solutions, cryptocurrency wallets, banking and email apps, and exfiltrates the information to a remote server.

Findings from security researchers suggest that Grandoreiro is rapidly evolving into sophisticated malware with novel anti-analysis properties that offers attackers full remote access and poses significant threats to employees and their organizations.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web