Grandoreiro
Grandoreiro is a long-running Brazilian banking trojan active since at least 2016 and described in the provided reporting as one of the most widespread banking malware families globally. It primarily targets Windows systems and has been used in aggressive phishing campaigns against banking customers, banks, and companies across Latin America and Europe, including Portugal, Spain, Mexico, Argentina, and Brazil. Reporting also states it is capable of stealing credentials associated with thousands of financial institutions across 45 countries and territories.
Observed delivery methods include phishing emails with malicious attachments or links, ZIP archives, highly obfuscated VBS scripts, MSI installers, direct executables, and DLL side-loading through legitimate software such as FastStone Image Viewer, MinGW, FreeMat, AbiWord, GoToMeeting, and Nero WiFi+Transfer. Recent campaigns used geofenced fake pages on abused Contabo infrastructure, MediaFire and Dropbox-hosted payloads, fake Adobe Reader update prompts, and ClickFix/ClearFake-style fake reCAPTCHA chains. One campaign used a batch dropper to download payloads from 177.136.230.88/modulo/ and establish persistence via HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\g2mstart while adding Microsoft Defender exclusions.
Grandoreiro is consistently described as Delphi-compiled malware. Reported capabilities include credential theft, stealing cookie data and credentials from Google Chrome, keylogging, clipboard monitoring, browser redirection, command execution, window manipulation, fake banking overlays/web injects, simulated mouse and keyboard movements, auto-update functionality, and exfiltration of collected data to command-and-control servers. It has also been observed collecting host information such as system GUID, computer name, language-related registry data, antivirus products, cryptocurrency wallet presence, e-banking applications, and checks for directories such as C:\Program Files (x86)\Bitcoin. In Brazil-focused campaigns, embedded overlays targeted Banco do Brasil, Bradesco, Caixa Econômica Federal, Itaú Unibanco, Santander, Sicoob, Sicredi, and Unicred, and impersonated banking security brands including GAS Tecnologia, Topaz OFD Anti-Fraud Intelligence, and Trusteer IBM. Those overlays were used to capture card passwords, electronic signatures, QR or BB-code validation codes, device serial numbers, and PIX confirmation codes; PIX QR-code interception and clipboard manipulation were also reported.
The malware uses multiple command-and-control mechanisms and evasion techniques. Reporting states it can use SSL for C2, send and receive C2 data via web services including Google Sites, and obtain C2 information from Google Docs. Other campaigns used AWS-hosted endpoints such as 18.212.216.95:42195 requesting /AudioCoreBCPbSecureNexusLink.xml, with 98.81.92.194:30154 also listed as a C2 endpoint. WatchGuard reporting described malicious DLLs using WebRTC-related protocols including STUN and ICE, plus integrations with Google Cloud Pub/Sub, Azure MQTT, Amazon MQTT, and the Binance API to blend traffic into noisy, legitimate-looking communications.
Grandoreiro includes substantial anti-analysis and defense-evasion functionality. Reported behaviors include API hooking, killing processes, breaking file system paths, changing ACLs to prevent security tools from running, anti-debugging via division-by-zero and UD2 instructions, deliberate execution errors, reverse-engineering and sandbox checks, geolocation verification through hxxp://ip-api.com/json, checks for analyst tools, suspicious execution paths, VMware-related registry keys, installed antivirus products via WMI, and the presence of software such as Google Chrome, FileZilla Client, CCleaner, Firefox, Acrobat Reader DC, Microsoft Edge, Skype, and Diamond Model. Some variants used CAPTCHA checks, binary padding to 400 MB, stolen code-signing certificates, and a DGA-based C2 system. Grandoreiro can also store configuration under HKCU\Software\ using frequently changing names including %USERNAME% and ToolTech-RM.
The malware is associated with the Brazilian banking malware ecosystem and is referenced as part of the Tetrade group in the provided content. It has also been historically linked in reporting to threat activity tracked by TA2725. Law-enforcement actions in 2021 and 2024 reportedly disrupted parts of the operation and led to arrests in Spain, Brazil, and Argentina, but the content states the malware remained active and re-emerged with updated variants in 2025 and 2026.
High-confidence indicators and artifacts mentioned in the content include domains and infrastructure such as uniaodownloadcnk.online, vmi<7-digit-number>.contaboserver.net, canalmodup.com, 177.136.230.88, 18.212.216.95:42195, 98.81.92.194:30154, 162.33.177.150, MediaFire and Dropbox-hosted payloads, and malicious DLL names including libwebp.dll, mingw10.dll, libffi-6.dll, libpng15.dll, g2m.dll, and Drivespan.dll.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TA2725 is a threat actor Proofpoint tracked since March 2022 that is known for using Brazilian banking malware (including Mispadu, Astaroth, and historically Grandoreiro) and credential phishing to target organizations mainly in Brazil, Mexico, and Spain.
In 2025, Brazilian-origin families such as Grandoreiro (part of the Tetrade group) stood out for their constant activity and global reach. Despite a major law enforcement disruption in early 2024, Grandoreiro remained active in 2025, re-emerging with updated variants and continuing to operate.
Techniques & procedures
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniquesCybercriminals are launching aggressive phishing campaigns to target banking customers across Europe and Latin America.
The email contains malicious links which redirects users to VPS or dedicated server hosted on Contabo's infrastructure... Once a user clicks on “Download PDF” button then it will download zip payload from another cloud storage and file-sharing service mediafire.com.
Execution
5 techniquesAnother one is the use of WbemScripting.SWbemLocator to make a connection to WMI using VBS. This connection is used to get the list of antivirus products installed on the machine.
This VBS concatenates large variables and tries to decode a base64 stream designed to drop a .zip file... then executes the “.exe” payload using Wscript.shell.
This second infection track relies heavily on highly obfuscated visual basic scripts sent via phishing links .
Clicking on the “Download PDF” button adds a JavaScript command which calls a declared async () function which checks for browser and platform using navigator.userAgent. From there, it retrieves a Mediafire.net URL from a PHP file...
Once a user clicks on “Download PDF” button then it will download zip payload... If a user clicks on the OK button, it performs a C2 connection with an AWS IP address to then start the stealing activity.
Stealth
5 techniquesCybercriminals are leveraging VPS hosting providers and obfuscation techniques to evade detection... The downloaded zip is sometimes password protected, and it contains large obfuscated VBS file. It contains lot of unwanted characters “:” used for obfuscation and it contains embedded Zip file in base64 encoded format and in chunks.
Then, a fake prompt appears on the screen instructing the victim to update Adobe Reader . If the user clicks the button, the system quietly executes the primary financial malware strain .
Another one is the use of WbemScripting.SWbemLocator to make a connection to WMI using VBS... Other checks are also made, like if it’s being running in a virtual environment by checking if the registry has some key attributed to VMWare.
Credential Access
3 techniques...then proceeds to steal credentials, log keystrokes, monitor the clipboard, and display fake banking overlays to capture login details.
It leads victims to download an obfuscated Visual Basic script and a disguised EXE payload designed to steal credentials.
...then proceeds to steal credentials, log keystrokes, monitor the clipboard, and display fake banking overlays to capture login details.
Discovery
5 techniquesIt also checks for system GUID from the registry, computer name and language from registry entry “HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions.”
It also checks for system GUID from the registry, computer name and language from registry entry “HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions.”
Another one is the use of WbemScripting.SWbemLocator to make a connection to WMI using VBS... Other checks are also made, like if it’s being running in a virtual environment by checking if the registry has some key attributed to VMWare.
Collection
5 techniquesIt checks for “C:\Program Files (x86)\Bitcoin” for possible personal data to steal.
...then proceeds to steal credentials, log keystrokes, monitor the clipboard, and display fake banking overlays to capture login details.
...then proceeds to steal credentials, log keystrokes, monitor the clipboard, and display fake banking overlays to capture login details.
...and display fake banking overlays to capture login details.
Occasionally, malicious actors employ encrypted or password-secured compressed files to conceal and deliver harmful software... The downloaded zip is sometimes password protected...
Command and Control
3 techniquesMoreover, these components leverage common web-conferencing protocols to communicate with adversary-controlled infrastructure . Security analysts noted that “The advantage for threat actors to use web conferencing traffic in their campaigns is due to this traffic be noisy, being difficult to be monitored” .
Two of the DLLs - mingwm10.dll and libwebp.dll - have been found to incorporate sgcWebSockets, a WebSocket and real-time communication library, for peer-to-peer (P2P) and WebRTC communications.
Once triggered, the script pulls a malicious executable from common cloud hosting environments .
IOCs tracked for this family
59 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
70 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A widespread banking trojan active since at least 2016 that targets banking customers and financial organizations. It is distributed via phishing and obfuscated VBS scripts, uses DLL side-loading with legitimate software such as FastStone Image Viewer and MinGW components, communicates covertly using noisy web-conferencing-like traffic, and includes anti-analysis and anti-debugging checks before executing banking overlays and stealing financial data.
A banking trojan active since 2016 that is delivered via phishing and uses techniques including DLL side-loading and obfuscated VBS scripts. It employs anti-analysis checks, abuses trusted cloud services for communications, and steals credentials, logs keystrokes, monitors the clipboard, and displays fake banking overlays to capture login details.
Banking trojan targeting Windows systems, primarily distributed via phishing emails. It steals banking credentials and sensitive data, uses DLL side-loading, anti-analysis checks, and WebRTC/P2P-related communications to evade detection, and targets financial institutions across multiple countries.
Banking trojan used in phishing-led campaigns that employs DLL side-loading and malicious VBS delivery, abuses legitimate cloud and hosting services, performs anti-debugging and anti-analysis checks, and supports credential theft, keylogging, clipboard monitoring, banking overlays, command execution, exfiltration, persistence, and code injection.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.