Blackmoon
BlackMoon, also known as KRBanker/KrBanker, is a banking trojan first observed targeting South Korean banking users, with reporting placing early analysis in 2014 and widespread activity from 2015 onward. Its original core behavior was credential theft via pharming and browser redirection: modifying the local Hosts file or later installing a local proxy auto-config (PAC) configuration to redirect victims from legitimate South Korean banking sites to attacker-controlled phishing pages. Reported phishing workflows collected banking credentials and personal information, and some variants also searched for South Korean NPKI certificate stores, archived certificate material with a hardcoded password, and exfiltrated it via HTTP POST.
Documented early distribution methods included drive-by downloads, adware, and exploit kits. Multiple reports describe BlackMoon using staged downloader frameworks and anti-analysis features. Observed techniques include encoded configuration retrieval from external sites such as lofter[.]com or social-media-hosted content, case-swapped Base64-style obfuscation, registry run-key persistence, PAC abuse via HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL, anti-debugging with vectored exception handlers, hardware breakpoints, timing checks, and process injection/process hollowing into suspended processes such as CACLS.EXE or svchost.exe.
Later reporting shows BlackMoon evolving beyond pure banking fraud into a multi-stage malware platform. A campaign tracked from November 2022 targeted businesses primarily in the United States and Canada and emphasized persistence, defense evasion, lateral movement, and monetization rather than only credential theft. In that activity, BlackMoon established persistence through a malicious Port Monitor tied to the Windows Print Spooler service, dropped RunDllExe.dll in C:\Windows\Logs, set HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\RunDllExe, modified Spooler privileges, disabled Windows Defender via HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware, blocked inbound RPC/SMB traffic with netsh ipsec rules, and injected a downloader into svchost.exe. Retrieved payloads included Hooks.exe, MpMgSvc.dll, MpMgSvc.exe, and WmiPrvSER.exe; the campaign deployed a spreader using EternalBlue/DoublePulsar-style components, scanned for ports 3306/445/1433, installed an XMRig Monero miner, and dropped traffic-sharing tools including ctfmoon.exe and Traffmonetizer.exe. Command-and-control in that campaign included hxxp://down.ftp21[.]cc/Update.txt.
BlackMoon has also appeared in India-focused phishing operations impersonating the Income Tax Department. In reporting from late 2025 to early 2026, tax-themed ZIP archives led to DLL sideloading and multi-stage payload retrieval, after which a BlackMoon variant was used specifically to evade Avast Free Antivirus by automating GUI actions to add malicious files to Avast exclusions. In those campaigns, BlackMoon activity was associated with deployment of the legitimate Chinese enterprise tool SyncFuture TSM, repurposed as an espionage framework for persistence, monitoring, remote control, and data exfiltration. eSentire stated that campaign had not been attributed to a known threat actor.
High-confidence indicators and artifacts mentioned in reporting include the mutexes \BaseNamedObjects\Brute_2022 and BaseNamedObjects\Win__Host; dropped paths such as C:\WINDOWS\8000 and C:\Windows\Logs\RunDllExe.dll; PAC-related registry changes under HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL; Defender policy modification at HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware; and C2/IP infrastructure including down.ftp21[.]cc, lofter[.]com-hosted configuration retrieval, 8.217.152[.]225:80, eaxwwyr[.]cn, 49.204.200[.]100, and historical IPs such as 100.43.129[.]107, 98.126.19[.]178, 174.139.200[.]164, 174.139.200[.]165, 174.139.203[.]180, 100.43.185.34, 174.139.0.211, 107.151.158.196, 206.161.216.35, 207.226.136.14, 100.43.185.42, 174.139.194.82, and 205.209.141.84. Reported sample hashes include MD5 7e67216628d9a171be0ce18c51fda8ce and 84e2d574085c77f47e801f5326e83d73, among others.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
malicious JavaScript through compromised web sites or advertisements led to the EK that exploited Adobe Flash vulnerabilities CVE-2014-0569 or CVE-2015-3133. We confirmed that final payload in both cases was KRBanker.
malicious JavaScript through compromised web sites or advertisements led to the EK that exploited Adobe Flash vulnerabilities CVE-2014-0569 or CVE-2015-3133. We confirmed that final payload in both cases was KRBanker.
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Some aspects of the campaign were previously highlighted by eSentire in January 2026, with the attacks using tax-themed lures to target Indian users with the Blackmoon malware.
Some aspects of the campaign were previously highlighted by eSentire in January 2026, with the attacks using tax-themed lures to target Indian users with the Blackmoon malware.
Some aspects of the campaign were previously highlighted by eSentire in January 2026, with the attacks using tax-themed lures to target Indian users with the Blackmoon malware.
Some aspects of the campaign were previously highlighted by eSentire in January 2026, with the attacks using tax-themed lures to target Indian users with the Blackmoon malware.
Some aspects of the campaign were previously highlighted by eSentire in January 2026, with the attacks using tax-themed lures to target Indian users with the Blackmoon malware.
Techniques & procedures
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniquemalicious JavaScript through compromised web sites or advertisements led to the EK that exploited Adobe Flash vulnerabilities
Initial Access
5 techniquesIn those cases, malicious JavaScript through compromised web sites or advertisements led to the EK that exploited Adobe Flash vulnerabilities CVE-2014-0569 or CVE-2015-3133. | Our analysis shows that KRBanker has been distributed through web exploit kits (EK) and a malicious Adware campaign... malicious JavaScript through compromised web sites or advertisements led to the EK that exploited Adobe Flash vulnerabilities CVE-2014-0569 or CVE-2015-3133. We confirmed that final payload in both cases was KRBanker.
Reportedly distributed through adware and exploit kits, we can see below that the BlackMoon perpetrators are consistently able to infect users, averaging 443 infections per day
BlackMoon is a banking Trojan that installs a proxy auto-config file (PAC) on an infected system in order to redirect users’ browsers to phishing pages related to South Korean banks.
Recent attack campaigns have also been observed transitioning from ValleyRAT delivered via malicious PDF attachments in phishing emails targeting Taiwanese organizations...
The attack begins when a victim receives a phishing email or visits a spoofed website carrying official government branding... The victim is then directed to click a download button, which immediately fetches a malicious ZIP archive onto their device.
Execution
1 techniqueAnother distribution channel is a malicious Adware program, called NEWSPOT... When visiting some Korean websites, a user may notice a pop-up of a browser add-on requesting installation for NEWSPOT. If installed, the adware is executed on the computer
Persistence
2 techniquesTo configure this, the Trojan starts a local proxy server and creates the following registry entry. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL = http://127.0.0.1:[random]/[random]
Blackmoon drops a dll into C:\Windows\Logs folder named RunDllExe.dll and implements a Port Monitor persistence technique... it calls AddMonitor API to immediately execute RunDllExe.dll and sets a driver value in HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\RunDllExe registry key to the malicious dll path.
Privilege Escalation
2 techniquesKRBanker uses Process Hollowing to execute its main code in a clean (non-suspicious) executable... KRBanker overwrites the whole clean process with its own (malicious) main module.
Blackmoon drops a dll into C:\Windows\Logs folder named RunDllExe.dll and implements a Port Monitor persistence technique... it calls AddMonitor API to immediately execute RunDllExe.dll and sets a driver value in HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\RunDllExe registry key to the malicious dll path.
Stealth
2 techniquesDefense Impairment
1 techniqueCredential Access
2 techniquesKRBanker uses a different technique known as “pharming.” This technique involves redirecting traffic to a forged website when a user attempts to access one of the banking sites being targeted by the cyber criminals.
KRBanker is also capable of taking the following actions: Stealing certification from NPKI directory in order to access online banking accounts
Discovery
1 techniqueCollection
1 techniqueCommand and Control
4 techniquesIt then registers the compromised system with the C2 server by sending the following HTTP GET request: http://[IP address]/ca.php?m=[encoded MAC Address]&h=[code page]
The latest version of the threat employs Proxy Auto-Config(PAC)... The adversaries abuse this feature for Pharming... When the browser attempts to connect to a web server, the traffic goes to the local proxy.
It downloads a file from URL described in the <update> section within the configuration data returned by the server... Banking Trojans like KRBanker and Venik has been installed through this update channel.
The IP address of the fraudulent server is not hard-coded in the malware. KRBanker obtains the server address by accessing Chinese SNS, Qzone through a Web API... The author of the trojan put the Pharming server address in the "nickname" field.
Impact
2 techniquesIt also stops and disables “Lanman” service... If the service is found, it will be disabled... or deleted by using the DeleteService API call.
Researchers at ALYac had reported previously, on KRBanker employing hosts file modification and local DNS proxy techniques to redirect HTTP traffic.
Other
2 techniquesIOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Banking malware distributed via fake tax-themed phishing campaigns targeting Indian taxpayers and businesses.
Malware used in tax-themed lure campaigns targeting Indian users, as referenced in prior reporting tied to Silver Fox activity.
Multi-stage backdoor delivered via phishing emails impersonating India's Income Tax Department; suspected espionage targeting Indian users.
A variant of the Blackmoon banking trojan is used in the attack chain to facilitate security evasion (e.g., adding files to Avast exclusions via automated mouse simulation) and to deploy a repurposed legitimate tool for persistence and espionage-style access.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.