Loading story…
Palo Alto Networks' Unit 42 reported increased activity from the KRBanker banking trojan, also known as Blackmoon, targeting financial institutions in South Korea. The malware was delivered through the KaiXin exploit kit and the NEWSPOT adware program, using Adobe Flash flaws CVE-2014-0569 and CVE-2015-3133 to infect victims. Once executed, KRBanker used process hollowing and contacted command-and-control infrastructure after pulling pharming server information from Qzone profile nickname fields.
Rather than relying on a traditional man-in-the-browser approach, KRBanker manipulated victims through pharming, redirecting traffic for selected Korean banks to fraudulent sites while legitimate URLs could still appear in the browser. The malware also abused Windows Proxy Auto-Config settings to steer banking traffic, stole digital certificates from the NPKI directory, and was capable of terminating AhnLab V3 security software, increasing the risk of credential theft and fraudulent banking transactions.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
On July 20, 2016, Fortinet published findings from monitoring BlackMoon command-and-control servers between May 10 and July 19, 2016, documenting at least 443 infections per day on average. The researchers collected 2,705 malware samples, identified 341 C2 IPs, and logged 23,013 victim records, indicating a large-scale operation centered on South Korea but also affecting users in the United States and Canada.
On May 9, 2016, Unit 42 published research detailing KRBanker’s behavior, including process hollowing, abuse of Windows Proxy Auto-Config settings, retrieval of pharming server addresses from Qzone profiles, theft of NPKI certificates, and termination of AhnLab V3 security software.
During the 2016 campaign, KRBanker was delivered through the NEWSPOT adware program and the KaiXin exploit kit. The exploit chain leveraged Adobe Flash vulnerabilities CVE-2014-0569 and CVE-2015-3133 to infect victims.
Unit 42 reported that the KRBanker banking trojan, also known as Blackmoon, had shown increased activity since early 2016 while targeting banks in the Republic of Korea. The malware focused on Korean financial institutions and used pharming to redirect victims to fraudulent banking sites.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research reported that the **Karius** banking Trojan was being distributed through the **RIG Exploit Kit** while still under active development. The malware was built to carry out browser-based **web injects**, modify legitimate online banking login pages, steal credentials, and exfiltrate the data to its command-and-control infrastructure. Researchers said Karius used an injector executable and two DLL modules to establish persistence, weaken some Internet Explorer protections, inject into `explorer.exe` and supported browsers, and pass stolen information through a named pipe before transmission. The sample appeared immature and likely in testing, with incomplete webinject targets, placeholder strings, and buggy early versions, but its code and behavior showed notable similarities to established banking Trojans including **Ramnit**, **Vawtrak**, and **TrickBot**.
Aug 15, 2026
The **Bizarro** banking Trojan, long associated with Brazilian cybercrime, expanded its operations to victims in **Spain, Portugal, France, Italy, Germany, Argentina, Chile, and Brazil**, broadening a campaign focused on stealing online banking credentials and enabling fraud. Researchers said the malware was delivered through spam emails that pushed victims to download **MSI installers**, which then retrieved additional payloads from compromised websites, hacked WordPress servers, and cloud-hosted infrastructure on **Azure** and **AWS**. Once installed, Bizarro used heavy obfuscation and a backdoor supporting more than **100 commands** to disrupt browser sessions, capture screens, log keystrokes, and hijack clipboard data. The operators also relied heavily on social engineering, displaying fake banking pop-ups, bogus security-update prompts, and requests for **two-factor authentication** codes, while also using malicious **QR codes** that could redirect victims to Android malware to extend the fraud chain beyond desktop systems.
Aug 14, 2026
Researchers reported that **JanelaRAT**, a Latin America-focused banking trojan derived from **BX RAT**, is actively targeting online banking and cryptocurrency users, with the heaviest activity in **Brazil** and **Mexico** and additional campaigns observed in **Chile** and **Colombia**. Kaspersky said it recorded **14,739 detections in Brazil** and **11,695 in Mexico** during 2025, as the malware continued to evolve from earlier VBScript-and-ZIP delivery chains to newer phishing-led infections using **MSI droppers**, **DLL sideloading**, obfuscated **.NET** payloads, and persistence through **Startup-folder LNK files**. Recent activity also included deployment of a malicious Chromium extension disguised as legitimate software. Once installed, JanelaRAT monitors browser and window titles for hard-coded banking and financial targets, then opens interactive **TCP** and **HTTP** command-and-control channels to support screenshots, keylogging, input injection, cursor control, remote command execution, and session hijacking. The malware uses encrypted strings, anti-analysis checks, daily rotating dynamic DNS infrastructure, and user inactivity monitoring to evade detection and help operators time fraudulent transactions. A notable feature is its overlay system, which displays fake banking prompts and Windows update screens to steal credentials and **MFA** tokens while suppressing user interaction.
Jun 29, 2026