Loading malware…
Grandoreiro is a Brazilian-origin Windows banking trojan written in Delphi and active since at least 2016. It targets banking customers primarily in Latin America, with activity also observed in Europe and North America. Its capabilities include stealing banking credentials and financial information, extracting credentials and cookies from Google Chrome, logging keystrokes, screen sharing, and remotely controlling infected devices. It collects host information, including usernames, computer names, security-product details, public IP addresses, and geographic location, and can store its configuration in the Windows Registry. Historical distribution has used phishing emails containing malicious links or attachments.
Grandoreiro campaigns employ geographic filtering and extensive anti-analysis measures to restrict execution and avoid research environments. A renewed campaign observed in May 2026 abused the legitimate Duplicate Files Finder application through DLL sideloading. Its loader concealed the application window and checked system uptime, hardware characteristics, recent user activity, virtualization artifacts, and running security and analysis tools before initiating command-and-control communications. It used encrypted strings, resolved command-and-control infrastructure through DNS-over-HTTPS, and issued encrypted requests containing host information to retrieve a second-stage payload. Campaign archives included decoy PDF and XML documents. Mexico was the principal focus of the observed activity, with additional detections in Spain, Peru, and Argentina.
A coordinated law-enforcement operation involving Brazilian and Spanish authorities and INTERPOL disrupted substantial portions of Grandoreiro's infrastructure in January 2024. The operation reduced activity but did not eliminate the malware, which continued operating and adapting its delivery and evasion techniques.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A new version of Grandoreiro malware from TA2725 targets both Mexico and Spain. Previously this malware has only targeted victims in Brazil and Mexico.
In 2025, Brazilian-origin families such as Grandoreiro (part of the Tetrade group) stood out for their constant activity and global reach. Despite a major law enforcement disruption in early 2024, Grandoreiro remained active in 2025, re-emerging with updated variants and continuing to operate.
43 distinct techniques documented for this family, organized by ATT&CK tactic.
208 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
134 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a comparison for geographic filtering that restricts malware delivery to selected regions and reduces exposure to outside researchers. The article does not establish its participation in the Casbaneiro campaign.
Mentioned as a comparison for geographic filtering that restricts malware delivery and reduces exposure to researchers outside the intended region. The content does not establish involvement in the Casbaneiro campaign.
Grandoreiro is a banking trojan active since at least 2016 that targets bank users. In this campaign it is delivered with suspected invoice-themed spam ZIP archives, uses DLL sideloading via a renamed legitimate application, checks for analysis environments and security tools, and—after passing those checks—uses Google's DNS-over-HTTPS resolver to contact C2 and request an encrypted second-stage payload while sending host profiling data.
Grandoreiro is identified as a banking trojan whose activity has reactivated in Latin America.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.