Loading threat actor…
Casbaneiro, also known as Metamorfo, is a Latin American banking trojan lineage primarily associated with financially motivated cybercrime targeting online banking and payment users, especially in Brazil. It is part of the broader Brazilian banking malware ecosystem and is known for focusing on Portuguese-speaking victims, monitoring banking activity, and enabling remote operator interaction to facilitate fraud and credential theft. Casbaneiro-related activity has been linked to campaigns that use social engineering and multi-stage malware delivery chains, including script-based loaders and packaged installers that deploy AutoIt-based components and in-memory payloads. Observed tradecraft includes victim fingerprinting for Brazilian locale settings, discovery of installed banking software, inspection of browser history for banking-related activity, and monitoring of windows associated with banks, payment services, and cryptocurrency platforms. The malware family has demonstrated anti-analysis and anti-virtualization checks, persistence via user-run registry mechanisms, encrypted payload staging, and process hollowing into legitimate Windows processes. Operational capabilities associated with this lineage include extensive backdoor control, credential theft, banking-session monitoring, browser termination prior to credential-focused actions, screen capture, file transfer, command execution, and banking-themed overlays or other mechanisms intended to capture sensitive information and facilitate fraudulent transactions. Casbaneiro has also been noted for using unconventional command-and-control support mechanisms, including storing encrypted or hidden operational data in YouTube video descriptions. The malware is widely tracked under the Casbaneiro and Metamorfo names and is regarded as a significant Brazilian banking trojan family.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
37 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a banking malware lineage whose delivery pattern and behaviors closely resemble the malware used in the Water Saci campaign.
Mentioned only as a comparison for using YouTube descriptions to store encrypted command-and-control information.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.