Loading malware…
Ranbyus is a Windows banking trojan focused on theft and manipulation of online-banking and remote-banking transactions, particularly in Ukraine and Russia. It has been tracked as Win32/Spy.Ranbyus and was reportedly used by Russian-speaking cybercriminals; some reporting also associates the name "triton" with the operators’ internal designation. Ranbyus has been observed targeting banking and payment software rather than relying solely on generic web-injection workflows, and it has been linked to attacks against remote banking environments including Java-based client-bank applications.
Its core functionality includes collection of host information, theft of banking credentials and payment data, interception of form data, screenshot capture, and exfiltration of stolen information to command-and-control infrastructure. Ranbyus has also been documented injecting into browser and Java-related processes and modifying Java code inside specific remote-banking applications. In targeted financial fraud scenarios, it can falsify displayed account balances and temporarily block banking software activity with deceptive maintenance messages to conceal unauthorized transactions.
A notable Ranbyus capability is abuse of smartcard-enabled banking workflows. The malware can detect smartcard readers and active smartcards, report device information to its operators, and manipulate smartcard communications at the SmartCard API level, including APDU command handling. This enables attackers to remotely leverage a victim’s authenticated smartcard session and bypass transaction-signing protections that would otherwise be expected to protect remote-banking operations.
Ranbyus also uses a domain generation algorithm for command-and-control resilience. Documented variants generated daily batches of candidate domains and revisited prior days’ domains across a roughly month-long sliding window, with later variants changing the second-level generation logic while preserving the overall callback pattern. Ranbyus has additionally been observed in criminal hosting ecosystems such as Avalanche and has been mentioned as a botnet service used within broader financially motivated cybercrime operations.
The malware is best characterized as banking-focused spyware/credential theft malware operating on Windows endpoints, with emphasis on financial fraud, remote-banking compromise, and stealthy post-compromise manipulation of banking sessions and transaction workflows.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
D’après Group-IB, Carbanak aurait souscrit à des services de botnets (tels que GoZ, Shiz et Ranbyus).
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Il se distingue par l’utilisation de techniques de type « Man-in-the-Browser », lui permettant de s’injecter dans les navigateurs web afin d’intercepter les identifiants bancaires, les données de formulaires et les cookies de session lors des connexions à des services bancaires en ligne.
77 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russian-speaking PC trojan listed in the report.
Viikon haittaohjelmakatsauksessa esittelemme Ranbyus-haittaohjelman.
Mentioned only as another malware family with a similar DGA bug.
Malware family hosted on Avalanche infrastructure; associated in the alert with credential theft and broader malicious activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.